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Abstract 


We study multiprover interactive proof systems. The power of classical multiprover inter- 
active proof systems, in which the provers do not share entanglement, was characterized in 
a famous work by Babai, Fortnow, and Lund (Computational Complexity 1991), whose main 
result was the equality MIP = NEXP. The power of quantum multiprover interactive proof 
systems, in which the provers are allowed to share entanglement, has proven to be much more 
difficult to characterize. The best known lower-bound on MIP* is NEXP C MIP* due to Ito and 
Vidick (FOCS 2012). As for upper bounds, MIP* could be as large as RE, the class of recursively 
enumerable languages. 

The main result of this work is the inclusion NEEXP = NTIME[22”""”] C MIP*. This 
is an exponential improvement over the prior lower bound and shows that proof systems with 
entangled provers are at least exponentially more powerful than classical provers. In our protocol 
the verifier delegates a classical, exponentially large MIP protocol for NEEXP to two entangled 
provers: the provers obtain their exponentially large questions by measuring their shared state, 
and use a classical PCP to certify the correctness of their exponentially-long answers. For the 
soundness of our protocol, it is crucial that each player should not only sample its own question 
correctly but also avoid performing measurements that would reveal the other player’s sampled 
question. We ensure this by commanding the players to perform a complementary measurement, 
relying on the Heisenberg uncertainty principle to prevent the forbidden measurements from 
being performed. 
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Part I 
Introduction 


1 Introduction 


This paper is about the complexity class MIP* of multiprover interactive proof systems with entan- 
gled quantum provers—the quantum version of the classical class MIP. Classically, the study of MIP 
has had far-reaching implications in theoretical computer science. In complexity theory, the proof 
by Babai, Fortnow, and Lund [BFL91] that MIP = NEXP was the direct antecedent of the PCP the- 
orem [ALM*98, AS98], a seminal result which is the foundation of the modern theory of hardness of 
approximation. In cryptography, the MIP model was introduced to allow for information-theoretic 
zero-knowledge proofs [BOGKW88], and more recently MIP protocols have become essential build- 
ing blocks in designing delegated computation schemes (see e.g. [KRR14]). These implications alone 
would be a sufficient motivation for considering the quantum class MIP*, but remarkably, the study 
of MIP* is also deeply related to long-standing questions in the foundations of quantum mechanics 
regarding the nature of quantum entanglement. Indeed, the MIP* model itself was anticipated by 
the nonlocal games or Bell tests introduced in the work of John Bell [Bel64], who was in turn 
inspired by the thought experiment proposed by Einstein, Podolsky, and Rosen [EPR35]. These 
nonlocal games have had applications to quantum cryptography [Eke91, MY98, Col06], delegated 
quantum computation [RUV13], and more. 

Even though the class MIP is now well-understood, it has proven difficult to determine the 
computational power of MIP*. A priori, it is not even clear that MIP* contains MIP, since adding 
entanglement could increase or decrease the power of the proof system. This is because the added 
resource of entanglement can make it easier for dishonest provers to cheat the verifier. Indeed, 
Cleve et al. [CHTW04] showed that for proof systems based on so-called XOR games (where the 
verifier’s decision can only depend on the XOR of the provers’ answer bits), the quantum class 
@MIP* C EXP, whereas classically MIP = NEXP. In particular, this result implied that the 
classical MIP protocol for NEXP of Hastad [Has97] could not be sound against entangled provers. 
In spite of this, Ito and Vidick [[V12, Vid16] were able to show that NEXP C MIP*, by proving 
that a different classical protocol is sound against entanglement. Note that the protocol of [Vid16] 
is identical to a protocol shown to be unsound by Cleve et al., except in that it uses 3 provers 
rather than 2 (the protocol is played by choosing a random subset of 2 provers from the 3). This 
illustrates the subtleties of dealing with entangled provers. 

With the lower bound NEXP C MIP* established, a natural follow-up question is whether MIP* 
is strictly more powerful than MIP. Indeed, it was long known that some MIP* protocols possess a 
uniquely quantum property called self-testing, which has no direct analog in the classical setting. 
Roughly speaking, an MIP* protocol is a self-test for a particular entangled state |} if only provers 
using states close to |W) can achieve close to optimal success in the protocol. In such a protocol, 
observing that the provers succeed with nearly optimal probability certifies that they share a state 
close to the target state |W). The germ of this idea came from the work of Bell [Bel64], who studied 
the types of bipartite correlations that could be obtained from measuring an entangled state called 
the EPR state, which had been introduced by Einstein, Podolsky, and Rosen [EPR35]. Bell gave a 
protocol where provers using the EPR state could succeed with a greater probability than purely 
classical provers, and subsequent works of Tsirelson [Tsi80], and Summers and Werner [SW88] 
showed that (a variant of) Bell’s protocol certifies the EPR state in the sense of self-testing. 

In order to prove stronger lower bonds on MIP*, the post-Ito-Vidick phase of MIP* research 
aimed to use this self-testing property to design protocols for problems in Hamiltonian complexity, 


the quantum analog of the theory of NP-completeness. In Hamiltonian complexity, the complexity 
class QMA plays the role of NP; it is the set of problems for which there exists a quantum witness 
state that can be efficiently checked by a polynomial-time quantum verifier. Problems in QMA 
seemed like a natural match for the powers of MIP* as one could potentially construct a protocol 
for QMA by designing a self-test for accepting witness states of some QMA-complete problem. 
The connection between MIP* and QMA was also well motivated from the point of view of the 
“quantum PCP” research program, which strives to find quantum analogues of the classical PCP 
theorem. In the classical setting, the PCP theorem can be viewed as a scaled-down version of 
MIP* = NEXP, showing that there exists an MIP* protocol for 3SAT (and thus for all of NP) with 
O(log(n))-sized messages. Drawing inspiration from this, Fitzsimons and Vidick [FV15] stated a 
“quantum games PCP conjecture”: that there should exist an MIP* protocol with log(n)-sized 
messages for the local Hamiltonian problem, and thus for the class QMA. This was proved by 
Natarajan and Vidick [NV 18a] in 2018 with a 7-prover protocol. Along the way to achieving this 
goal, [NV18a] developed a highly efficient self-test for high-dimensional entangled states: their 
“quantum low-degree test” is a self-test for n EPR pairs with only O(log(n)) communication. 

Already, the result of [NV18a] is strong evidence that MIP* #4 MIP, since it is believed that 
QMA Æ NP. But, at the same time, several other works showed that even larger separations 
were possible in the regime of subconstant soundness gaps. Here there are results in two settings. 
For MIP* with a soundness gap scaling inverse-exponentially (i.e. 1/exp(n)) in the instance size, 
Ji [Ji17] showed a protocol for NEEXP: nondeterministic doubly-exponential time, and a subsequent 
work by Fitzsimons, Ji, Vidick, and Yuen [FJVY19] showed protocols for non-deterministic iterated 
exponential time (e.g. NTIME(22")) with a correspondingly small soundness gap (e.g. 2702”) 
the “gapless” case, Slofstra [Slo16, Slol9] showed that given a description of an MIP* protocol, 
determining whether there exists an entangled strategy that succeeds with probability exactly 1 is 
undecidable by any Turing machine. 

These results hint at the full power of MIP* but are not conclusive, as it is not unusual for 
quantum complexity classes to increase significantly in power when a numerical precision parameter 
is allowed to shrink. For instance, QIP (quantum interactive proofs with a single prover) with an 
exponentially small gap is equal to EXP [IKW12], while QIP with a polynomial gap is equal to 
IP = PSPACE. Likewise, QMA with exponentially small gap (known as PreciseQMA) is known to be 
equal to PSPACE [FL18], while QMA is contained PP, and QMA(k) (QMA with multiple unentangled 
Merlins) with exponentially small gap is equal to NEXP [Per12], whereas in the constant-gap regime 
the best known lower bound is that QMA(k) D QMA. Moreover, even the QMA lower bound for 
MIP jog obtained by [NV18b] holds for 7 provers only; with 2 provers, the best known lower bound for 
MIP ioe is NP = MIPiog [NV18a]. Could it be that 2-prover MIP* is equal to MIP, with entanglement 
providing no advantage at all? 

This paper conclusively answers this question in the negative. Our main result (Theorem 1.1) 
is to show that MIP* contains NEEXP, with only two provers and with a constant completeness- 
soundness gap. This is establishes the first known unconditional separation between MIP* and MIP 
in the constant-gap regime: previously, such a separation was known only assuming QMA + NP, 
and only in the scaled-down setting of logarithmic-sized messages. 


. In 


Theorem 1.1 (Theorem 17.12 inthe body). There is a two-prover, one-round MIP* protocol for the 
NEEXP-complete problem Succinct-Succinct-3Sat with completeness 1, soundness 1/2, and question 
and answer length poly(n). 


As a corollary of Theorem 1.1, we obtain a lower bound on the hardness of approximation for 
the entangled value w* of a nonlocal game. 


Corollary 1.2. There exists a constant c < 1 such that given a two-prover nonlocal game Y of size 
N, the problem of deciding whether w*(Y) = 1 or w*(Y) < 1/2, promised one of the two holds, is 


NTIME(2""*  ™)-hard. 
For two-player games, the best prior lower bound was NP [NV18b]. The lower bound achieved 


in Corollary 1.2 is stronger as for any c < 1, the function 2% eS ig superpolynomial. 


Techniques. Our construction, inspired by [Jil7] and [FJVY19], involves “compression”: we 
show how to take an MIP protocol for NEEXP with exponentially-long questions and answers (the 
“big” protocol), and simulate it by an MIP* protocol with polynomial-sized messages (the “small” 
protocol). However, the techniques we use to achieve our compression are quite different. We 
eschew the Hamiltonian-complexity ideas that were used in previous works, and in particular the 
use of history states. In our protocol, honest provers need only share a quantum resource state of 
(exponentially many) EPR pairs, together with a classical assignment to the NEEXP instance being 
tested. The use of history states was the main barrier preventing previous works from applying to 
the case of two provers. 

We divide compression into two steps: question compression and answer compression. We 
achieve question compression by a technique which we call introspection, in which we command 
the provers to perform measurements on their shared EPR pairs whose outcomes are pairs of 
questions from the “big” protocol. To force the provers to sample their questions honestly, we 
use a variant of the quantum low-degree test from [NV18a], which certifies Pauli measurements 
on exponentially many EPR pairs using messages of only polynomial size. A crucial challenge 
is to prevent each prover from learning the other prover’s sampled question, since this would 
destroy the soundness of the “big” protocol. To achieve this, we use the “data-hiding” properties of 
quantum measurements in incompatible bases: if a set of qubits is measured in the Pauli X-basis, 
this “erases” all information about Z-basis measurements. This means that if Alice samples her 
question by measuring her half of a block of EPR pairs in the Z-basis, then her question can be 
hidden from Bob by forcing him (via self-testing) to measure his half of the EPR pairs in the 
X-basis. Interestingly, our data-hiding scheme does not operate in a black-box way on the “big” 
protocol, but rather makes essential use of its structure. In particular, we start with a “big” protocol 
based on a scaled-up version of a PCP construction using the low-degree test, where the question 
distribution consists of pairs of random points in a vector space and affine subspaces containing 
them. The linear structure of the vector space is essential for our data-hiding procedure to work. 

Our approach to answer compression is more standard, essentially using composition with a 
classical PCP of proximity. Here, the verifier asks the provers to compute a PCP proof that 
their “big” answers satisfy the success conditions of the protocol, and verifies this PCP proof by 
reading an exponentially smaller number of bits. Care is needed to deal with entanglement between 
the provers. The first, fundamental challenge we face is that the success condition of the “big” 
protocol is a function of both provers’ answers. Thus, to compute a PCP proof that the condition is 
satisfied, one of the provers must have access to both provers’ answers. Classically, this is achieved 
using the technique of oracularization, in which one prover receives both provers’ questions and 
is checked for consistency against the other prover, which only receives a single question. In the 
entangled setting, this oracularization procedure is sound, but not necessarily complete. This is 
because oracularization requires that each prover, if given the other prover’s question, could predict 
its answer with certainty, even though this answer is obtained from a nondeterministic quantum 
measurement. In our protocol, we are able to use oracularization because honest provers always 
use a maximally entangled state, which they measure with projective measurements that pairwise 
commute for every pair of questions asked in the game. While this commutation requirement is 


restrictive, it still permits non-trivial quantum behavior; indeed, the linear system games used by 
Slofstra [Slo19] involve similar commutation conditions. 

The second challenge is to ensure that the PCP of proximity we use for composition is itself 
sound against entanglement. We achieve this by performing a further step of composition: we ask 
the provers to encode their PCP proof in the low-degree code and verify it with the low-degree test, 
which is known to be sound even against entangled provers [NV18b]. This technique was introduced 
in the QMA protocol of [NV18a] in order to perform energy measurements on the provers’ state. 


Implications and future work We believe that our work opens up several exciting directions 
for further progress. For the complexity theorist, the most obvious future direction is to obtain 
even stronger lower bounds on MIP* by iterating our protocol, as in [FJVY19]. At the most 
basic level, we could imagine taking our MIP* protocol for NEEXP and performing a further layer 
of question compression and answer compression on it, thus obtaining an MIP* protocol with 
logarithmic message size for NEEXP, or, scaling up, an MIP* protocol with polynomial message size 


oly(n) 
for NTIME(22"__ ) 
could obtain potentially obtain lower bounds of NTIME(2’ ) on MIP* while retaining a constant 


. By further iterating question reduction and answer reduction k times, we 


completeness-soundness gap. The main obstacle to acter such results is that the question 
compression procedure developed in this paper is tailored to a special distribution of questions 
(that of the MIPexp protocol for NEEXP), whereas our answer compression procedure produces 
protocols whose question distribution is not of this form. 

Assuming that this obstacle can be surmounted, we could aspire to a more ambitious goal: 
a general “gap-preserving compression procedure” for some subclass of MIP* protocols, which we 
may label “compressible” protocols. Such a procedure would consist of a Turing machine that takes 
as input any compressible MIP* protocol ¥, and generates a new compressible protocol Y’ with 
exponentially smaller message size, but approximately the same entangled value. It was shown 
by [FJVY19] that the existence of such a compression procedure for the set of all MIP* protocols 
would imply that MIP* contains the set of all computable languages, and moreover that there exists 
an undecidable language in MIP*. These consequences would continue to hold as long as the set 
of compressible protocols contains a family of protocols solving problems in NTIME(f(n)), where 
f(n) is a growing function of n. 

Showing that MIP* contains undecidable languages would be significant not just for complexity 
theory but also for the foundations of quantum mechanics, as it would resolve a long-standing open 
problem known as Tsirelson’s problem. Tsirelson’s problem asks whether two notions of quantum 
nonlocality are equivalent: the tensor-product model, in which two parties Alice and Bob each act 
on their respective factor of a tensor-product Hilbert space Halice 9 Hpob, and the commuting- 
operator model, in which both parties act on a common Hilbert space H, but the algebra of Alice’s 
measurement operators must commute with Bob’s, and vice versa. It was shown by Slofstra [Slo16] 
that in the “zero-error” setting, these two models differ: there are quantum correlations which 
can be exactly achieved in the commuting-operator model but not in the tensor product model. 
Surprisingly, showing that MIP* contains undecidable languages would imply that the two models 
are separated even in the bounded-error setting: it would imply that there exist correlations that can 
be achieved in the commuting-operator model that cannot even be approximated (up to constant 
precision) in the tensor-product model. The reason for this implication is that if the two models 
are indistinguishable up to bounded error, then there exists a Turing machine that can decide any 
language in MIP* and is guaranteed to halt. This observation, which is folklore in the community, 
follows from the completeness of the non-commutative sum of squares hierarchy for the commuting- 


operator model, as documented in [FJVY19]. Showing a separation between the two models would 
have significant mathematical consequences as well, as it would yield a negative answer to the 
long-standing Connes’ embedding problem. 

In addition to these connections to complexity and mathematical physics, we hope that our 
results will have applications in other areas such as to delegated computation or quantum cryptog- 
raphy. In particular, our use of introspection is reminiscent of ideas used in quantum randomness 
expansion, where randomness generated by measuring EPR pairs is used to generate questions 
for a nonlocal game. Could our results improve on the infinite randomness expansion protocol of 
Coudron and Yuen [CY 14]? 
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2 Overview of our proof 


In this section we give a more detailed overview of the technical parts of the paper. 


2.1 Basic quantum notation and qudits 


While the main body of the paper contains a more complete set of quantum preliminaries in Section 4, 
for the purposes of this introduction we define some basic notation, aimed at the reader who is 
familiar with the standard quantum computing formalism over qubits but is less familiar with qu- 
dits: quantum systems of dimension not equal to 2. In this paper, we make extensive use of such 
qudits: in particular, for a finite field Fg, we will consider qudits of dimension Q, with a basis state 
|i) for every element i € Fg. Under tensor product, we obtain a basis for the space of M qudits of 
dimension Q where each basis state |£} corresponds to a vector z € FY. 

The basic resource state used in our protocols will be the EPR state over 2M qudits of dimension 
Q. The qudits are split into two registers of M qudits each, held by the two provers Alice and Bob, 
respectively. 


|EPRY) = 


aan `> |x T) alice ® |Z) Bob * 


xey 


This state is a maximally entangled state between Alice and Bob. 

Acting on this state, we will ask the provers to perform measurements from a special class 
called Pauli basis measurements. To define these over a general field Fg requires the introduction 
of some finite field technology, in particular the finite field trace function. For simplicity, in this 
overview we will imagine that Q is prime, allowing the addition in Fg to be identified with the 
additive group Zg, and simplifying the definition of the Paulis; in the main body of the paper, we 


will work with Q a power of 2. For a single qudit of dimension Q, the Pauli X and Z bases are the 
sets {|7x*) }uero and {rő }uero of vectors 


Iž) = 5 SO wela), [rd 


xzEFQ 


where w = exp(27i/Q) is the Q-th root of unity. We denote the projectors onto these basis states 
by 7% and 77, respectively. For a system of M qudits, the Pauli X and Z observables are a set. of 
generalized observables indexed by elements of F™: a generalized observable is a Hermitian matrix 
with eigenvalues that are Q-th roots of unity. They are given by 


X(v) = So a, Ben Oa, Z(v) = DE AER 


UM? UM? 
M M 
ucFo ucFo 
; M 
where u1,..., um are the components of the vector u, and u-v is the dot product 7," , uj: vi. Mea- 


suring a generalized observable means performing a projective measurement onto the eigenvectors 
of the observable, with the outcome a corresponding to the eigenvector with eigenvalue w”. 


2.2 Our starting point: a classical interactive proof for NEEXP 


We start with a classical multiprover interactive proof protocol for NEEXP. The equality MIP = 
NEXP was originally shown by Babai, Fortnow, and Lund [BFL91] using a protocol based on the 
multilinearity test: the idea is that an exponentially-long witness for a problem in NEXP is encoded 
in the truth-table of a multivariate polynomial function over a finite field, which is linear in each 
of the variables individually. The verifier is able to verify the witness by evaluating the multilinear 
polynomial over appropriately chosen points and subspaces. To scale up to NEEXP, we use a much 
more efficient version of the same idea, replacing the multilinearity test with the low-degree test, 
which works with multivariate polynomials of low total degree. This more efficient construction 
comes from the PCP literature. We give a relatively self-contained presentation of the protocol 
in Section 11. For the purposes of this overview, it is sufficient to know the following: any problem 
in NEEXP can be reduced to satisfiability for a doubly exponentially long 3Sat formula, succinctly 
encoded by a polynomial-sized circuit. (We refer to this problem as Succinct-Succinct-3Sat). Given 
a 3Sat formula ~, we would like the provers to prove to us that they have a satisfying assignment a 
to this formula. Instead of reading the assignment directly, we will ask the provers to encode their 
assignment as a multivariate polynomial ga : FY — Fg, where the number of variables M and the 
finite field size Q are appropriately chosen parameters, and return evaluations of this polynomial. 
To check that a satisfies Y, the verifier first uses a technique called arithmetization to convert the 
formula ~ into a multivariate polynomial gy : Fo" tk Fg. The polynomial g,, is chosen such 
that the assignment a satisfies w if and only if the expression 


Saty, a(x, b, w) = gy(x,b, w) - (ga(z1) — b1)(Ga(%2) — b2)(ga(x3) — b3) 


is equal to 0 at every point in a particular subset H C Fov +k Our classical protocol for NEEXP 
checks this condition: 


Informal Theorem 2.1 (Section 11 in the body). There exists a protocol % for Succinct-Succinct- 
3Sat (and hence NEEXP), where the verifier’s questions to the provers are constant-dimension 
subspaces of FM, and the provers’ responses are evaluations of degree-D M -variate polynomials on 
these subspaces. The parameters M,Q, D are all chosen to be exp(n), and hence the question and 
answer lengths as well as the runtime of the verifier in this protocol are exp(n). 
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The distribution over subspaces sent to the provers in % is relatively simple, and in fact is in- 
dependent of the instance of Succinct-Succinct-3Sat being tested. For the purposes of this overview, 
the reader can take the distribution over pairs of questions to be the plane-point distribution D. A 
pair (s,u) ~ D consists of a uniformly random affine plane s C F¥, which is sent to Alice, and a 
uniformly random point u € s which is sent to Bob. The full distribution over questions in % is 
more complicated than this but the essential ideas of our protocol will be illustrated by restricting 
to this case. 


2.3 Restricting the strategies: registers and compilers 


One of the main challenges in working with entangled provers is showing soundness against general 
entangled strategies. An important technique in this area is to force the provers to use a particular 
state and class of measurements by playing a type of game known as a self-test. 


Informal Definition 2.2. A game Kest is a self-test for a state |Y) and measurements M” if any 
strategy that succeeds in Gest with probability 1 — e must use a state |y’) and measurements (M‘)* 
that are 6(€)-close, in the appropriate metric, to |W) and M”. 


Some of the earliest self-tests include the famous CHSH game, which self-tests the Pauli X 
and Z operators on a single EPR pair (of qubits). Self-testing technology has greatly advanced 
over the years, and in this paper we design a highly efficient self-test based on the low-degree test 
of [NV 18a]. 


Informal Theorem 2.3 (Theorem 6.2 in the body). The Pauli basis test Pauli(n,q) is a self-test 
for the state |EPR{) and the Pauli X and Z basis measurements. This test sends the players 
questions of length O(log(n)) and receives answers of length O(poly(n)). 


The Pauli X and Z measurements are “complete” measurements, and as a consequence, there 
is no nontrivial measurement on a set n qudits that can be measured jointly with both the Pauli X 
and Z measurements on those qudits. Using this property, we design a game called the data-hiding 
game, which certifies that a prover’s measurements act trivially on a specified set of qudits. 


Informal Theorem 2.4 (Theorem 8.3 in the body). The data-hiding game Gide is a self test for 
states |Y) = |EPR{) @ |aux) and measurements M® of the form M* =1@(M")3,,- It has questions 
of length O(log(n)) and answers of length O(poly(n)). 


Together, the Pauli basis test and the data-hiding game allow us to restrict our analysis of our 
protocols to a class of strategies we call register strategies: strategies for which the shared state is 
a collection of £ registers, each in an EPR state, together with some auxiliary register: 


|b) = |[EPR3}) @... @ JEPRG) @ laux), 


and where the provers can be commanded to perform either (1) Pauli basis measurements on 
specified subsets of the registers, or (2) measurements that do not act on specified subset of the 
EPR registers (but act on the auxiliary register or the remaining EPR registers). We formalize 
this by designing a compiler, which takes in a protocol Y that is complete and sound for register 
strategies, and produces a new protocol 9’ which is complete and sound over all strategies. 


Informal Theorem 2.5 (Theorem 7.2 and Theorem 9.2 in the body). Suppose Y is a protocol 
for a computation problem for which completeness and soundness hold for register strategies, with 
O(1) many registers of size n. (That is, for YES instances of the problem, there exists a register 
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strategy achieving value 1, and for NO instances, no register strategy achieves value greater than 
1/2). Let the questions in Y be of length Q and the answers be of length A. Then there exists a 
protocol Y' which is complete and sound for general strategies, and for which the question length is 
Q + log(n) and the answer length is A + poly(n). 


The compiled protocol Y’ either runs the original protocol Y, or, with some probability, runs 
the Pauli basis test, the data-hiding game, or a consistency test. 


2.4 Question reduction through introspection 


With our compiler in place, we have now given the verifier the power to command the provers to 
perform Pauli basis measurements on a set of EPR pairs. We would like to use this to reduce the 
question size of the classical protocol % for NEEXP described above from exp(n) to poly(n). We 
will do so by forcing the provers, rather than the verifier, to sample the protocol’s exp(n)-length 
questions, a technique we call “introspection”. That is, we would like to force the provers to sample 
pairs (s, u) from the plane-vs-point distribution D, where s is a uniformly random affine plane in 
FY , and u a uniformly random point on s. 

To design a scheme to sample from this distribution, let us first fix a representation of affine 
planes. We will represent an affine plane by an intercept u € FM and two slopes v1, v2 € FY . The 
plane given by u, v1, v2 is the set s = {u + A1v1 + A202 : A1,A2 € Fa}. As a first attempt, we may 
try the following scheme: 


1. Alice and Bob share three registers, each of which contains an EPR state, so their shared 
state is 
lvo) = IEPRG) p, 9 |EPRG ) p, Q [EPR } p, - 


2. Alice first measures her half of registers Rı and Rə in the Pauli Z-basis, to obtain uniformly 
random outcomes v1, v2. The shared state is now 


1) = IEPRO) p, @ (11) alice ® V1) Bob) Ra 8 ([v2}atice ® V2) Bob) R2- 


3. Now, Alice and Bob both measure register Ro in the Pauli Z-basis, both obtaining the same 
outcome u. The shared state is now 


|¢h2) = (|e) aice 8 u) Bob) Ro @ (101) alice @ 101) Bob) Ri @ (102) alice 8 [V2} Bob) R2- 
Alice sets her plane s to be s¥ and Bob sets his point to be u. 


Indeed, the pair (s, u) generated by this procedure is distributed according to D. However, there 
is a problem: through her measurement, Alice obtains additional side information, specifically the 
value of Bob’s point u. Can we command Alice to erase the side information? In fact, we can, 
using the Heisenberg uncertainty principle: if two observables anticommute, then measuring one 
completely destroys information about the other. Using this idea, we modify our protocol as follows: 


1. As above. 


2. As above. At this point, applying the definition of |EPRY ), we can write the shared state as 


V1) x oS (lu) aice @ |) Bob) Ro @ (11) alice 8 1¥1) Bob) Rr 8 (V2) alice Q 1¥2) Bob) R2- 


M 
ucFo 
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3. New: Intuitively, we would like Alice to be prevented from measuring the component of the 
intercept along the directions v1, v2. This information would be obtained by measuring the 
observables! Z(v1),Z(v2). To destroy it, we will ask Alice to measure the complementary 
Pauli observables X (v1), X (v2) on register Ro, obtaining outcomes a1, a2 € Fg. The shared 
state is now 


lh) SIT | watan ju + Avi + uva) (Upon | (121) atice @ 11) Bob) Rs 
— amm 


U AH ul Alice Ro 


& (lv2} Alice 8 [v2}Bob) Rə- 


where, as above, w = exp(2ri/Q) is a Q-th root of unity. Alice and Bob’s state on Rọ is 
now a uniform superposition over pairs u, u’ of points lying on the same affine subspace with 
slopes v1, V2. 


4, Alice and Bob both measure register Rọ in the Z basis, obtaining outcomes u and u’, respec- 
tively. The shared state is now 


23) = (lu) alice 8 lu’) Bob) Ro @ (11) Alice 8 [v1)Bob)Rı ed ([v2} alice 8 [v2}Bob] Re: 
Alice sets her plane to be s¥ and Bob sets his point to be w’. 


Now, from the calculation performed above, it’s clear that Bob’s point u’ is uncorrelated with Alice’s 
intercept u, apart from lying in the plane s¥, and hence there is no further information about Bob’s 
point that Alice can learn by measuring her portion of the final state |43}. But Alice still obtains 
some additional information from her measurements along the way, in particular the outcomes 
Q1,Q2 of the X measurements. And moreover, how can we certify that the X measurements were 
performed correctly, since they are not Pauli basis measurements as given to us by the compiler? To 
answer these questions, we define a new game called the partial data-hiding game (Theorem 10.4), 
which certifies that Alice and Bob perform the steps described above and that no extra information 
is leaked. Building on this game, we can now design a protocol for NEEXP with small question size: 


Informal Theorem 2.6 (Theorem 15.8 in the body). There is an MIP* protocol @ for NEEXP 
with questions of length poly(n), and answers of length exp(n). The verifier can generate the 
questions in poly(n) time but needs exp(n) time to verify the answers. 


2.5 Answer reduction through PCP composition 


We have succeeded in obtaining a game with short questions, but the answers are now exponentially 
long. In the last step, we will use composition with a classical probabilistically checkable proof 
(PCP) to delegate verification of the answers to the provers. 

Schematically, the protocol @ consists of the following steps: 


1. The verifier sends Alice a question 2 and Bob a question y. 
2. Alice returns an (exponentially-long) answer A and Bob an exponetially-long answer B. 


3. The verifier computes a verification predicate V(x, y, A, B) in exponential time. 


‘Strictly speaking, this is only true when vı - vı Æ 0 and v2- v2 40. A more rigorous treatment of this is given 
in Section 10. 
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We would like to delegate the last step to the provers by asking them to compute a PCP proof 
that V(x, y, A,B) = 1, which the verifier can check by communicating only polynomially many 
bits with the provers. However, we face an obstacle: Alice cannot know y and B, and neither can 
Bob know x and A, and distributed PCPs (where neither party knows the entire assignment) are 
known to be impossible [ARW17]. To proceed, we will first have to modify @ by oracularizing it: 


1. The verifier sends Alice the questions x, y, and Bob either æ or y, chosen uniformly at random. 
2. Alice returns exponentially-long answers A, B, and Bob returns an answer C. 


3. The verifier computes a verification predicate V (æ, y, A, B) on Alice’s questions and answers, 
and further checks that A = C, if Bob received x, or that B = C, if Bob received y. 


The idea is that the new Alice simulates both Alice and Bob from the original protocol, and the 
new Bob certifies that the new Alice does not take advantage of her access to both questions to 
cheat. It is well-known that oracularization does not harm the soundness of interactive protocols, 
be they classical or quantum. However, in the quantum world, it is not necessarily the case that 
the oracularized protocol retains completeness. This is because Alice and Bob may have been asked 
to perform non-compatible measurements in the original protocol, rendering it impossible for the 
new Alice to simulate both the original Alice and Bob. Fortunately for us, the honest strategy for 
protocol Y% is such that completeness under oracularization. 

Now that a single prover is in possession of all inputs to the verification predicate V, we can 
implement our idea of using a PCP proof. Classically, this idea is known as PCP composition, 
and is extensively used in the PCP literature. In the quantum case, the requirement to maintain 
soundness against entanglement makes composition technically difficult, and we defer the details 
to Part V of the paper. Once the composition is performed, we reach our main result. 


Informal Theorem 2.7 (Theorem 17.12 in the body). There is an MIP* protocol % for Succinct- 
Succinct-3Sat (and hence for NEEXP) with question size, answer, and verifier runtime poly(n). 


2.6 Organization 


The paper is organized into five parts. The first part is the introduction and this overview. The 
remaining parts are organized as follows. 


e Part II contains two sections of preliminaries, one containing the classical background and 
another the quantum background. 


e Part III contains the register compiler, i.e. the proof of Informal Theorem 2.5. This involves 
designing the Pauli basis test (Section 6) and the data hiding test (Section 8). Section 5 
serves as an introduction to this part and contains more details on the organization. 


e Part IV contains the “introspection” question reduction step, i.e. the proof of Informal Theorem 2.6. 


To begin, we sketch the classical MIP protocol for Succinct-3Sat in Section 11. Then we give 
the introspected, i.e. “big”, low-degree test in Section 13, and finish by giving the entire small- 
question NEEXP protocol in Section 15. Section 14 contains a test necessary for the protocol 
called the “intersecting lines test”. It allows us carry over the results of the low-degree test 
from one register to another. 


e Part V contains the answer reduction, i.e. the proof of Informal Theorem 2.7. The construc- 
tion involves composing PCP protocols with error-correcting codes, and so Section 16 surveys 
the properties we need of an error-correcting code. Finally, Section 17 contains the actual 
proof of the answer reduction step. 
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Part II 
Preliminaries 


3 Classical preliminaries 


3.1 Finite fields and polynomials 


In this section we review some basic facts about finite fields and polynomials over them. These 
facts can be found in a standard reference such as [MBG*13]. Let p be a prime and q = pÝ bea 
prime power. We denote by Fp and F, the finite fields with p and q elements, respectively. The 
field F, is called the base field or prime subfield of Fj. The larger field F} can be viewed as a 


t-dimensional vector space Ff over the smaller field. We define the trace tr : Fy > F, by 


The trace is a linear map under linear combinations with coefficients drawn from Fp. 
A basis for F} over Fp consists of k elements {a1,...,a,}, such that any element u € F} can be 
written as a linear combination 
k 
u = > CiQi, 
i=1 


where the coefficients c; € Fp. Two bases {a;} and {8;} are dual bases if tr[a;b;] = ĝij, where 4;; 
is the Kronecker delta function. 


Fields of characteristic 2 : When p = 2 (i.e. q is even), several useful properties hold. Most 
importantly for us, the field Fy has a self-dual basis: that is, there exists a basis {a;} such that 
tr[a;a;] = di; [MBG*13, Theorem 1.9]. This means that given a field element u = >; ciai, we can 
recover the coefficient c; by the expression c; = tr[ua,]. 


Fourier identities Below, we give two useful identities for simplifying Fourier sums over finite 
fields. We set w = e?™/P to be a p-th root of unity. 


Fact 3.1. Euer, wtlwa] — 0 if a is nonzero. 


Proof. If a # 0, then there must exist some nonzero y € F} such that tr[ay] # 0. Let the value of 
the expectation we want to compute be denoted by o. Then we have 


c= E tt lau] 
uc 


E yttlauty)] 
uc 


yy tlay] E yt lau] 
uck, 


tt lau g 


and thus o = 0. o 


Fact 3.2. Let V be a subspace of Fj. Then Eu~v wua] — 0 ifa g Vt. 
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Proof. The idea is the same as the proof of the previous fact. Suppose a ¢ V+. Then there exists 
some nonzero y € F% such that tr|(a,y)] # 0. Letting the value of the expectation we wish to 
compute be denoted o, we have 


and hence o must vanish. oO 


3.2 Two-player one-round games and MIP 


A two-prover nonlocal game is an interaction between a verifier and two noncommunicating provers, 
in which the verifier samples a pair of random questions and sends them to the provers, receives 
a pair of answers, and decides whether to accept or reject based on the questions and answers. In 
the literature, a game is usually taken to be described by the verifier’s distribution over question 
pairs, together with a table describing the verifier’s behavior for all possible choices of questions and 
answers. For our purposes, it will be more convenient to work with uniformly generated families 
of games, which are specified by Turing machines that sample the questions and decide whether to 
accept or reject given the questions and answers. 


Definition 3.3 (Two-player one-round uniform game family). A two-prover one-round game uni- 
form game family Y is an interaction between a verifier and two provers, Alice and Bob. The 
verifier V = (Algo, Alga) consists of a “question” randomized Turing machine Algo and an “an- 
swer” deterministic Turing machine Alga. Given an input string input, the verifier samples two 
questions (£0, %1) ~ Alga(input) and distributes ag to Alice and a; to Bob. They reply with 
answers ag and ay, respectively, and the verifier accepts if Alga (input, £o, £1, a0, a1) = 1. A strat- 
egy for Alice and Bob is said to be classical if they are allowed shared randomness but no shared 
quantum resources. The value of Alice and Bob’s strategy is simply the probability that the verifier 
accepts, and the classical value of the game is the maximum value of any classical strategy. We 
write Q-length(¥Y) for the maximum bit length of the questions as a function of the input input, 
and similarly A-length(Y) for the maximum bit length of the answers, Q-time(Y) for the maximum 
running time of Algo, and A-time(Y) for the maximum running time of Alga. Often we will not 
explicitly write the dependence of these quantities on input. 


Definition 3.4 (Multiprover interactive proofs). A 2-player 1-round multiprover interactive proof 
protocol is a uniform game family f as in Definition 3.3. For parameters 0 < s < c < 1, we say 
that the protocol Y decides the language L with completeness c and soundness s if the following 
three conditions are true. 


o (Completeness) Suppose input € L. Then there is a classical strategy for Y with value at 
least c. 


o (Soundness) Suppose input ¢ L. Then every classical strategy for Y has value at most s. 


o All of Q-length(Y), A-length(Y), Q-time(Y), and A-time(¥Y) are poly(n) where n is the bit 
length of input. 


The class MIP... is the set of all languages that can be decided by multiprover interactive proof 
protocols with the parameters c, s. 
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If c — s is a constant, then we will suppress the dependence on them when writing MIP and 
just say that L € MIP. Here, “c” is referred to as the completeness and “s” is referred to as the 
soundness. We will typically deal with the case when c = 1 and s = 1 — e, where e > 0 is a small 
constant. 


In this definition of MIP, the parameters Q-length(Y), A-length(Y), Q-time(Y), A-time(Y) are 
required to be polynomial in the input length n. However, in this paper, several of the intermediate 
results we achieve are protocols where these parameters scale superpolynomially (indeed, even 
exponentially or worse) in n. In these cases, we will explicitly indicate the dependence of these 
parameters on n. 


3.3 Low-degree code 


Let q be a prime power and h < q be an integer. Let H be a subset of Fy of size h. For n > 0, let 
x € H”. The indicator function of x over H” is the polynomial with inputs y € Fj" defined as 


inde Tits Noex,p 4x; (yi — b) 
7 Mi Hoeg tte, (ti — 6) 


There are two properties of this polynomial that we will need: 


(i) that it is low-degree, i.e. a degree-m(h — 1) polynomial, 


(ii) that for any z,y € H™, indy s(y) = 1 if and only if z = y, and otherwise indy, s(y) = 0. 
Using this, we can define the low-degree code. 


Definition 3.5 (Low-degree encoding). Let |S| < h™, and let 7: S — H™ be an injection. Then 
the low-degree encoding (sometimes also called the Reed-Muller encoding) of a string a € ed is the 
polynomial ga : Fj’ — F; defined as 


Gt) = 5 ai indy nç) (2). 
1ES 
By the properties of the indicator function above, (i) ga is a degree-m(h — 1) polynomial, and 
(ii) ga(m(2)) = a; for all i € S. We will typically, though not always, take S = [|n]. Given an 
error-correcting code, there are two key properties we care about: the rate and the distance. The 
rate of the low-degree code is n/q™. As for the distance, we can estimate it with the following 
lemma. 


Lemma 3.6 (Schwartz-Zippel lemma [Sch80, Zip79]). Let f,g be two unequal m-variate degree-d 
polynomials over Fg. Then 


Pr (f(x) = g(@)| < d/q. 


m 
s~EFg 


As a result, the low-degree encoding has relative distance m(h — 1)/q. In a typical application, 
we would like a code with large rate and distance. To achieve this, we will often use the following 
“rule of thumb” setting of parameters: 


h = O(log(n)), m=0 (a) ; q = polylog(n). (1) 


This gives a code with rate 1/poly(n) and distance o(1). The polynomials involved are degree 
d = O(log(n)?/ log log(n)). 


17 


3.4 A canonical low-degree encoding 


The low-degree encoding affords us some flexibility when choosing the parameters and the injection; 
however, for our application we will have to choose these with care, because each of our uses of the 
low-degree code requires that the injection m be efficiently computable. In this section, we give a 
simple, canonical choice for the subset H and the injection m so that this is true. 


Definition 3.7. We say that n, h = 2°, q = 2, and m are admissible parameters if tı < t2 and 
h” >n. 


The following definition gives the canonical encoding. 


Definition 3.8 (Canonical low-degree encoding). Let n, h = 24, q = 22, and m be admissible 
parameters. Set £ = tı - m. The canonical low-degree code is defined as follows. 


(i) Let e1,...,€t, be a self-dual basis for F} over F2. Then we set H to be the subset 
H := Ha t = {b1 -e1 + + bh -en | b1,.--, de, E Fo}. 
As desired, |H| = h. 
(ii) Let o := don,t : {0,1}" — Hint be the bijection o(b1,..., bu) = bi -e1 ++ + de, < ey. From 
this, we can construct a bijection cgt 4. : {0,1} + H™ by setting 
Otti talbi,- - be) = Co (b1, ... bt), O (be 4525 Boe); 2s. o9 0 (Oey iss be): 
(iii) Given an index i € [|n], write bing(i) for its -digit binary encoding. Then we define the 
injection 7 := Tet to : [n] > H™ as n(i) = ov t,t, (bing(2)). 
The following proposition gives the time complexity of the canonical low-degree encoding. 


Proposition 3.9. The bijection o¢ 4,1. and the injection T := Tetit, are both computable in time 
m-polylog(q). As a result, given a string a € FG and a point x € F;", the value ga(x) takes time 
poly(n,m,q) to compute. 


3.5 Low-degree testing 


Definition 3.10 (Surface-versus-point test). The surface-versus-point low-degree test with parame- 
ters m, d, q (a prime power), and k, denoted %urface(m, d, q, k), is defined as follows. Let v1,..., vz 
be k uniformly random vectors in Fj", and let s be a uniformly random affine subspace parallel to 
span{v1,...,v,} (that is, s is the set {w + A1v1 +: + ÀkUk : Ad... Ax © Fg} for a uniformly 
random w), and let u be a uniformly random point on s. Given these, the test is performed as 
follows. 


o The vectors v1,...,v% and the surface s are given to Alice, who responds with a degree-d 
polynomial f : s > Fy. 


o The point u is given to Bob, who responds with a number b € F4. 


Alice and Bob pass the test if f(w) = b. 
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Remark 3.11. Let us remark briefly on the encodings used in this test. A surface s with directions 
U1,-++,Uz is encoded by the string (u, w1,..., Wk) € Bete Here, u is the lexicographically 
minimum point in s, and w1,...,w, are the rows of the matrix produced by taking the matrix with 
rOWS U1,..., Ug and transforming it to reduced row echelon form. We note that given v1,..., Ug and 
a point u € s, this encoding can be produced in time poly(n, k, log(q)). 

A function f : s — Fy is a degree-d polynomial on s if there exists a degree-d k-variate polynomial 
f: F% — F, such that f'(A1,..., Ap) = f(u +àiw1 +- +Agwk). When s is already known, we can 
encode f by specifying f’, which involves writing out its d{k] := ou coefficients in some arbitrary 
but fixed order. 


We note that this definition of the surface-versus-point test differs slightly from the standard 
definition of the surface-versus-point test in two respects. First, we do not require that the vectors 


V1,...-, Uk be linearly independent or even nonzero, which implies that there is a 
1 k-1 k 
1-(1-<) (:-4)..-<) <L 
q q q q 
chance that s is less than k-dimensional. Second, we send the vectors vj,...,v,% to Alice in 


addition to the description of the surface s. It is not hard to see that these two modifications do 
not asymptotically harm the soundness guarantee obtained for the standard plane-versus-point test 
shown by Raz and Safra [RS97], which we restate here. 


Theorem 3.12 ({RS97]). There exist absolute constants c,d > 0 such that the following holds. 
Suppose Alice and Bob pass Gurface(M,d,q,2) with probability at least u. Then there exists a 
degree-d polynomial g : Fj’ — Fq such that 


Pr [glu) = b] > w—c-m(d/q)". 


(s,u) 


Explicit values for c,c’ have been derived by Moshkovitz and Raz [MR08], albeit for the weaker 
guarantee that g be a degree-md polynomial, which is still sufficient for most applications. 


Communication cost. We can compute the communication cost of this test as follows. 
o Question length: We encode a plane in Fj” with a string (u, v1, v2) € i This requires 
3m log(q) bits to communicate. 
o Answer length: A degree-d bivariate polynomial on Fy can be described with (°) < 


d+ 1)? coefficients in F,. These require (d + 1)? log(q) bits to communicate. 
q 


Recalling Equation (1), a typical setting of parameters gives questions of length O(log(n)), and 
answers of length O(log(n)*/ log log(n)). 
3.6 Simultaneous low-degree testing 


Definition 3.13 (Simultaneous surface-versus-point test). The simultaneous surface-versus-point 
low-degree test with parameters m, d, q (a prime power), k, and £, denoted FE rtace (M, dq, k), 
is defined as follows. A draw (s,u) is sampled as in {surface(mM, d, q, k). Given this, the test is 
performed as follows. 


o The surface s is given to Alice, who responds with ¢ degree-d polynomials f1,..., fe: s —> Fg. 
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o The point u is given to Bob, who responds with £ numbers 6j,..., be € Fg. 
Alice and Bob pass the test if f,;(u) = b1,..., folu) = be. 


Classically, the k = 2 case of this test can be reduced to a slight generalization of Theorem 3.12 
using a simple and standard union-bound argument. Quantumly, however, a corresponding entanglement- 
sound analogue of this generalization is not known to hold. Instead, we use a slightly more involved 
reduction in which the £ outputs of Alice and Bob are “combined” to create a strategy for the 
“standard” plane-versus-point test. (This technique is standard and was also used in the proof of 
Lemma 4.6 in [NV 18a] for the case £ = 2.) In this section, we will introduce the notation needed for 
this reduction and carry out the proof of the classical soundness of the simultaneous low-degree test 
as a warm-up for our proof of quantum soundness later. We begin by showing how to combine @ 
functions by introducing @ “indexing” variables. 


Notation 3.14. Let g1,...,9¢ : s + F4 be functions, where s is a subset of Fp. Then we define 
the new function combine,(z, y) : Fé & s — F; as follows: 


combineg(x, y) = £1 : gı (y) +- + £e- gely). 
We will typically apply this with s = Fj" or s a dimension-k subspace of Fẹ. 


If the g;’s are degree-d polynomials on Fj’, this produces a degree-(d + 1) polynomial on i ee 
First, we show that given a surface-versus-point query from this (¢+m)-dimensional space, we can 
produce a surface-versus-point query from the m-dimensional space. 


Proposition 3.15. Given a subset s C piem, let Sproj = {y | (£, y) € Fe @ Fj}. 


o If s is a dimension-k subspace of pi, then Sproj is a dimension-k' subspace of Fg for 
k' <k. 


, ; ; ; m a 
Define 8° ~k Sproj to be a uniformly random dimension-k subspace of Fẹ containing Sproj- 


o Ifs and (x,y) are distributed as surface l+ M, q, k), then s! ~ Sproj and y are distributed as 
Psurface (m, q, k) d 


Proof. The first bullet follows because if {(x1, y1), ..., (£k, Yk)} is a set of k linearly independent 
vectors which span s, then {y1,...,y,} is a set of k vectors which span Sspan, though they may no 
longer be linearly independent. The second bullet follows by symmetry. O 


Next, we show that answers to the queries on the m-dimensional space can be used to produce 
answers to the queries on the (£ + m)-dimensional space. 


Proposition 3.16. Let s be a dimension-k subspace of F£+™, and let s! C F™ be a subspace which 
q q 


contains Sproj- Then Os is a subspace, and it contains s. In particular, if f,,..., fe are degree-d 
functions on s', then combines is a degree-(d+ 1) function on Fé Q 8’, and it can be restricted to a 
degree-(d + 1) function on s. 


Proof. Consider a point (x,y) € s. Then y € Sproj E 8’, and so (x,y) € Fe & s. The statement 
about combines follows immediately. O 


Finally, we need a technical result: that nonlinear low-degree polynomials rarely become linear 
after restricting variables. 
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Definition 3.17. Let n > 0. A function f : oe — F; is exactly linear in x if it can be written as 


f(z,y) =21- fily) +: + ze: fely). 


(We do not allow constant terms.) Note that when n = 0, such a function can be written as 
C1 -£1 +++- + Ce: £e, where each c; € Fy, in which case we simply call it “exactly linear”. Given 
a function f(x,y) and a string y € Fy’, we will also write f|y for the function defined as fy(x) = 


q ? 
f(x,y). 


Proposition 3.18. Suppose f(x,y) : va — F; ts a degree-d polynomial which is not exactly 
linear in x. Then the probability that f|y is exactly linear, over a uniformly random y ~ Fẹ, is at 
most d/q. 


Proof. Because f is not exactly linear in z, it contains some non-linear z-monomial x’ = a} e ai in 
which i1 + --+%, is either zero or at least two. Thus, f can be written as f(x,y) = x'-g;(y)+ f’(z,y), 
where g;(y) is degree-d and f’ contains no x’ terms. For f|y to be exactly linear, this term must 
vanish, which means g;(y) = 0. But by Schwartz-Zippel (Lemma 3.6), this happens with probability 
at most d/q. oO 


We are now ready to prove soundness of the simultaneous low-degree test in the k = 2 case. 


Theorem 3.19. There exists absolute constants c,c' > 0 such that the following holds. Suppose Al- 
ice and Bob pass Ge ta; d,q,2) with probability at least u. Then there exist degree-d polynomials 


91;---,9¢: FP — Fq such that 


Pr [gi (u) = bi,..., ge(u) = by] > p — c- (m+ O(d/q)°. 


(s,u) 


Proof. Let c, > 0 be as in Theorem 3.12. We pick the constants in this theorem, say ¢, ĉ so that 
p—e-(m+O((d+ Y/q)* — 2d +1)/q > u — ê: (m+ O(d/q)°. 


Note that this means that the theorem is trivial when 2(d + 1)/q > u — c- (m+ A((d+1)/q)”. As 
such, we will assume below that 


2(d+1)/q<p—e-(m+2£)((d+1)/q)°. (2) 


Suppose Alice and Bob pass a (M, d,q,2) with probability at least u. We will use them 


to simulate two provers, “Combined Alice” and “Combined Bob”, who pass the single-function 
low-degree test Yurface(4 + Mm, d + 1,q,2) with probability at least u. They are specified as follows: 


o Combined Alice: Given s C Pm, draw s’ ~9 Sproj- Give it to Alice, who responds with 
fi,---,f¢: 8’ + Fy. Output the function combine fs. 


o Combined Bob: Given (a, y) € perm, compute y € Fp’. Give it to Bob, who responds with 
b,...,6¢ E€ Fy. Return combine, (x) € F4. 


By Proposition 3.15, s’ and y are distributed as the questions in GE rtace(™, d, q, 2). Using our 
assumption on Alice and Bob, this means that f,(y) = b1, ..., fely) = be with probability at least 
u. As a result, (combine s|s)(x, y) = combiney(y) with probability at least u. By Proposition 3.16, 
combine f|s is a degree-(d+ 1) function on s, and so it is a valid response to subspace queries. This 
means Combined Alice and Bob pass %urface(@ + m,d+1,q,2) with probability at least u. 
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Thus, we can apply Theorem 3.12. It gives a degree-(d + 1) function g : All — F, such that 


Pr[g(w,y) = combinep(w)] > u — c- (£+ m) - (d+ 1/0)". (3) 


We would like to show that g is exactly linear in x. Assume for the sake of contradiction that this 
is not the case. Because b depends only on y (and Bob’s internal randomness), we can consider 
varying these two variables independently of x. By Proposition 3.18, the probability that gy is not 
exactly linear is at least 1 — (d+ 1)/q. In this case, because combinep(a) is always exactly linear, 
the probability that g|,(a) = combinep(x) is at most (d + 1)/q by Schwartz-Zippel (Lemma 3.6). 
As a result, the probability that g(x,y) = combine,(x) is at most (d + 1)/q + (d+ 1)/q, which 
contradicts Equations (2) and (3). Thus, we may conclude that g is exactly linear in z. 

This implies that we can write g(x,y) = >>, xi - gi(y), where each g; is a degree-d polynomial. 
Now, for any fixed b and y, if it is not the case that gı(y) = b1, ..., gely) = be, then the probability 
that g(x,y) = combine,(a) over a random =z is at most 1/q by Schwartz-Zippel since both are 
exactly linear functions. Thus, if 7 is the probability that gi(y) = bi, ..., gely) = be, then 
the probability that g(x,y) = combine,(a) is at most 7 + (1 — 7)/q < 7 + 1/q. Combined with 
Equation (3), this implies the theorem. o 


3.7 NEXP, NEEXP, and complete problems for them 


Definition 3.20. The class NEEXP (respectively, NEEXP) is the class of all problems that can be 
solved in exponential (respectively, doubly-exponential) time by a nondeterministic Turing machine. 
Formally, 


NEXP = |_) NTIME(2”), NEEXP = [J NTIME(22” ). 
cEN cEN 


A standard way of generating NEXP-complete problems is by considering “succinct” versions 
of NP-complete problems, in which an exponential-sized input is encoded by a polynomial-sized 
circuit. The canonical complete problem is a succinct version of 3Sat, but there is considerable 
freedom in choosing the succinct encoding used. We choose the following encoding. 


Definition 3.21. Succinct-3Sat is the following problem. 


o Input: a circuit C with 3n + 3 input bits and size poly(n). It encodes the 3-Sat instance wc 
with variable set x, for u € {0,1}" which includes the constraint (et V ae V r?) whenever 


C(u1, U2, Us, b1, b2, b3) = 1. 
(Here, x} refers to the literal z; and x° refers to the negated literal 77.) 
o Output: accept if pe is satisfiable and reject otherwise. 


A proof that Succinct-3Sat is NEXP complete can be found in [Pap94, Chapter 20], albeit with 
a different encoding. Below, we show this implies NEXP-completeness for our encoding as well. 


Proposition 3.22. Succinct-3Sat is NEXP-complete. 


Proof. Papadimitriou [Pap94] considers circuits Cpap which encode 3Sat formulas ¢ with n variables 
and m clauses as follows: Cpap takes as input a string (b, u, k), where b,k € {0, 1}? are interpreted 
as integers in {0,1,2,3} and u € {0, 1}!°8(™) is interpreted either as a vertex 1 < u < n or a clause 
l<u<m. Ifl1<u<nand0<k< 2, then on input (0, u, k), Cpap outputs the index of the clause 
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where Tq appears for the k-th time, and on input (1, u, k), it outputs the index of the clause where 
Zu appears for the k-th time. (In addition, if 1 < u < m and 0 < k < 3, then on input (2,u,k), 
Cpap outputs the k-th literal of the u-th clause in ¢. We state this for completeness, though we will 
not need it for the proof.) Such a 3Sat formula 7 has 2n literals, each occurring 3 times, and so 
m = 2n. By [Pap94, Chapter 20], this succinct encoding of 3Sat is NEEXP-complete. Using this, 
we can generate an instance of the Succinct-3Sat problem C such that ¢¢ = @ as follows: given 
input (u1, u2, U3, b1, b2, b3), we simply evaluate Cpap on (bj, ui, k), for each 1 <i < 3 and 0 < k < 2, 
and output 1 if there is any clause containing all three literals. O 


The complete problem for NEEXP is, appropriately enough, a succinct version of Succinct-3Sat. 
To define it precisely, it helps to fix a notion of a Boolean circuit. Following Section 4.3 of [Pap94], 
we consider Boolean circuits in which each gate can be one of six types: input, true, false, A, V, or 
=. These gates have 0, 0, 0, 2, 2, or 1 inputs, respectively. A succinct representation of a circuit 
Cı is a circuit Cə that, given an index i, outputs the type of gate 7 as well as the indices 71, jo of its 
inputs (one or both of these indices may be the null index Ø depending on the type of the gate i). 


Definition 3.23. Succinct-Succinct-3Sat is the following problem. 
o Input: a circuit C with size poly(n), which is a succinct representation of a circuit C’, which 
is itself an instance of Succinct-3Sat with instance size N = 2Ply(”), 
o Output: accept if Wer (the 3Sat formula on 2% = garam) 
C’) is satisfiable and reject otherwise. 


variables generated by the circuit 


Fact 3.24. Let M be a deterministic Turing machine which takes two inputs 21,22. Then for any 
input xı of size nı and for any size parameter no and time T > ny + no, there exists a circuit 
CM,T,x, of size N = O(T?) which, on an input x2 of size no, computes M run for T steps on the 
input pair x1,2%2. Moreover, there exists a Turing machine M’ that given x1, no, and an index 
i € {1,...,N} in binary, outputs in polynomial time the type of the ith gate of Cura, and the 
indices jı, jh of the inputs to this gate. 


Proof. The construction in the proof of Theorem 8.1 of [Pap94] yields a circuit of the desired size. 
This circuit consists of O(T?) copies of a constant-sized circuit Cm that depends only on M. O 


Theorem 3.25 (Cook-Levin). Let L be a language in NTIME(T(n)). Then the following properties 
hold: 


1. For every string x of length n, there exists a 3Sat formula ®, on n! = poly(T(n)) variables 
Z1,---,2n', such that x E€ L iff ®, is satisfiable. 


2. There exists a Turing machine R that given an input x of length n, three indices u1, u2, u3 € 
{1,...,'} in binary, and three bits b1,b2,b3 € {0,1}, runs in poly log(n’) = poly log(T(n)) 


time and outputs 1 iff the clause (2b, z?2, z>3) is included in ®,. 


Proof. We follow the proof of Theorem 8.2 of [Pap94] to obtain the 3Sat instance ®,. oO 
Theorem 3.26. Succinct-Succinct-3Sat is complete for NEEXP under polynomial time mapping 
reductions. That is, for any language L in NEEXP, there exists a Turing machine R which takes as 


input a string x € {0,1}", and in time poly(n) outputs an instance Cy of Succinct-Succinct-3Sat, 
such that Cz is satisfiable iff x € L. 
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Proof. Suppose we start with a language L € NEEXP. This means there is a nondeterministic 
Turing machine M which decides L in time Tọ = go By Theorem 3.25, there exists a Turing 
machine Rı which runs in time T} = poly log(Tọ) = 2°) such that given input x and clause 
indices i = (u1, U2, U3, b1, bg, b3), represented as a binary string of length |i| = log(poly(Tp)) = 
log(202”")) = O(2”*), runs in time polynomial in Z and outputs 1 iff the corresponding clause 
exists in a 3Sat formula ®, such that x € L iff ©, is satisfiable. 

Now, if we apply Fact 3.24 to Rı, with x playing the role of the first input xı and i the role of 
the second input, we obtain that for every x there exists a circuit CR, T, of size O(T?) = 20(n°) 
which takes as input a tuple of indices 7, and runs R; for time T; on this time to output whether 
clause 7 is present in the formula ®,. Moreover, there exists a Turing machine Rə that, given x, 
the size parameter |i| = O(2”°), represented in binary as a string of O(n°) bits, and an index j, 
represented as a string of O(n°) bits, outputs the jth gate of Cr, T,= in time Tz = poly(n). Note 
that Rə is a Turing machine which takes in input of size poly(n) and runs in time poly(n). 

We are now almost where we need to be. In the final step, we once again apply Fact 3.24 to 
Rə, obtaining a third Turing machine Rg that takes as input x and the size parameters, and an 
index k, and generates the kth gate of the circuit Cr, 7,2. corresponding to running Rg for To steps. 
Finally, by fixing the dependence of the size parameters on the size of x, and iterating through all 
possible values of the index parameter, we obtain a Turing machine R4 that takes as input x and 
runs in time poly(n), and outputs the complete description of a Succinct-Succinct-3Sat instance Cy 
with the desired properties. O 


3.8 The Tseitin transformation 


In this section, we introduce the Tseitin transformation, which is a simple method of converting a 
Boolean circuit into a Boolean formula. 


Definition 3.27 (Tseitin transformation). Let C be a Boolean circuit with n input variables 
T1,---;Zn and s gates. Then the Tseitin transformation of C, denoted F := Tseitin(C), is the 
Boolean formula defined as follows. 


(i) Introduce new variables w1, ...,Ws corresponding to the output wires of the gates in C. Then 
the input variables to F consist of £1,..., £n along with w1,..., Ws. 
(ii) Each gate in C operates on one or two variables in {£1,..., £n, W1, ..., Ws}. Write gi(x, w) for 


the function computed by the i-th gate. Then F computes the intermediate expression 
zi = (gi(x, w) A wi) V (gi(x, w) A Ti). 
The final output of F is z1 A (z2 A (++ A Zs)). 


By construction, C(x) = 1 if and only if there exists a w such that F(x, w) = 1 (in particular, w 
is taken to be the wire values of C on input x). In addition, F contains exactly 7s + (s — 1) gates, 
meaning that it has size O(s). 


Next, we show how to convert Boolean formulas into functions over Fy. 


Definition 3.28 (Arithmetization). Let F be a Boolean formula of n variables and size s. The 
arithmetization of F over F4, denoted arithg(F), is the formula produced by the following two-step 
process. 


(i) Transform F by replacing all V gates with appropriate ^A and ~ gates. 
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(ii) Transform each Boolean gate into an F} gate as follows: Replace each ^ gate in F with a x 
gate. Replace each = gate with a x —1 gate followed by a +1 gate (enacting the transformation 
b € Fa =œ 1 — b). Call the resulting formula arithg(F). 


Set Farith := arith (F). On inputs x € {0,1}", Farith(z) = F(x). On general inputs x € Fẹ, 
Farith(£) is computable in time poly(s, q). 


The following proposition shows that small Boolean formulas have low-degree arithmetizations. 


Proposition 3.29 (Low-degree arithmetization). Let F be a Boolean formula of n variables, size s, 
and m gates. Then arithg(F) is a degree-s polynomial over F}. 


Proof. By induction on the number of gates, the base case (m = 0) being trivial. For the induction 
hypothesis, assume the proposition holds for Boolean formulas which have fewer than m gates. 
Either the gate at the root of F is a — gate or an {V,^}-gate. In the former case, F = —F’ 
for some Boolean formula with m — 1 gates, and so arithy(#) = 1 — arith (F) by construction. 
But these have the same degree, and so arith,(F) is degree s by the induction hypothesis. In the 
latter case, assume without loss of generality that it is an A-gate. Then F = Fieft A Fright for two 
formulas of size Sjeft + Sright = 8$ and fewer than m gates. By the induction hypothesis, arith, (Fieft ) 
has degree-sjeg, and arithg(Frignt) has degree-s;yignt, and so arithg(F) = arithg(Ficg) x arithg(Frignt) 
has degree s. O 


The arithmetization procedure describe in Definition 3.28 can also be applied to general Boolean 
circuits C, not just Boolean formulas. But Proposition 3.29 does not apply to general circuits; in 
fact, the arithmetization of a Boolean circuit can have very high degree, even if that circuit is small. 
This motivates using the Tseitin transformation: it allows us to convert a small circuit into a small 
formula, which has a low-degree arithmetization. 


4 Quantum preliminaries 


4.1 Quantum measurements 


The most general notion of a quantum measurement is a POVM measurement, which consists of 
a set of Hermitian operators {Ma }acs indexed by outcomes a from a set S. These satisfy the 
conditions 


Va, Ma = 0, SMa =]. 
a 


To refer to the measurement as a whole we will use the letter M, without the subscript indicating 
the outcome. For a state |W), the probability that the measurement M returns outcome a is 


Pr[a] = (4| Ma |Y) . 


A POVM is said to be projective if each element M, is an orthogonal projector, i.e. M2 = 
Ma. Note that this implies that M,M, = 0 for any a Æ b, i.e. that the projectors are pairwise 
orthogonal. Naimark’s theorem says that any POVM measurement can be simulated by a projective 
measurement on an enlarged space. 


Theorem 4.1 (Naimark). Suppose {Ma} is a POVM acting on a Hilbert space H. Then there 
exists a projective measurement {M} } acting on the space H ® Haux together with a state |aux) 
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such that for all states |Y) € H and all outcomes a, the post-measurement state after applying M 
and M' is the same: 


V/Ma |) (V| V Ma = traux(Ma (|) (W| @ Jaux) (aux) Ma). (4) 


As a consequence, M and N induce the same distribution over outcome probabilities: 


(Y| Ma |) = KYI 8 (aux) Na (1Y) 8 |aux)). 


Moreover, given any upper-bound n on the number of outcomes of Ma, there is a universal choice of 
the state |aux) that works for all POVMs M, with at most n outcomes. The projective measurement 
M} and state |aux) together constitute a Naimark dilation of the POVM Ma. 


Theorem 4.2 (Partial Naimark). Suppose {Maaz} is a POVM acting on a tensor product Hilbert 
space H = H1 Q Ho of the form Maaz = Ha, Q Agl, where the operators {Ia,}a, 18 a projective 
measurement. Then there is a Naimark dilation Mj, a, and a state |aux) as above, with the property 
that Mi, as = Ha, S AG for projectors AZ} acting on H2 8 Haux- 


a2 


Proof. The condition that {IIq,} forms a projective measurement implies that for each a1, {AG} 
is a POVM. By Theorem 4.1, for each a; there exists a POVM A?! dilating AG}, and all of these 
POVMs act on the same universal auxiliary state |aux). Now, define Mj, a = Ha, ® Af. For 


a1,41 
every state |y}, we have that 


traux Ma, aa (lW) (pl) Ma, a>) = traux Ag (Ta, |W) (V| Ha, 8 |aux) (aux|) Aga) 
= Aaz (Ta, Ip) (y| Mai) V Aaz 
= V Maz ,a2 lY) (a| V Ma: a2» 


where in going from the first to the second line we used Theorem 4.1. O 


For the purposes of this paper, we will need to specialize the POVM notation introduced above in 
several ways. First, we will often work with families of POVM measurements indexed by questions 
in an interactive proof protocol. These will be denoted {M4}, where q indexes the question and a 
the outcome. (We note that the reverse convention “{M?}”, which we will not use, is also common 
in the literature.) In many cases, the outcomes will consist of tuples of elements, some of which 
we may wish to discard. We use the convention that if an outcome element is not written, it is 
understood to be summed over. Thus, if {M7’,} is a family of POVMs, we would have 


Mz =Y Moy (5) 
b 


Notation 4.3. We will also often consider situations where some of the information in a mea- 
surement outcome is discarded. In particular, given a POVM {My} whose outcomes are functions 
f: U — V over some domain U, and given a point x € U, we will denote by {M 52) =y tyev the 
measurement corresponding to applying M to obtain a function f, and returning the value of f at 
x. Formally, the POVM elements of this measurement are given by 


Mraza >> My. 
fieza 


(We note that Equation (5) can be viewed as a special case in which the “discarding function” f 
simply removes the second coordinate. For this case, it is simpler to use the convenient notation 
in Equation (5) than the more cumbersome bracket notation given here.) 
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The following lemma contains a useful fact about marginalized projective measurements. 


Lemma 4.4. Let Map be a projective measurement on a tensor product Hilbert space Hı ® Ho, 
and suppose that for alla, Ma = Aa ® Ba where Ag is a rank-one matrix on Hy. Then for all a,b, 
Map = Aa ® Cap with Ca p projectors. 


Proof. By the Schmidt decomposition, we can write Ma,b as 


Mab = `> \ba,b,3) (Ya,b,5 | 
J 


= Y aye [tange anin] @ Wage? Watje: 
jk 


Write the rank-one matrix Aa as an outer product |W) (Pal. Then we have 


S Mas = Y. Cjr [tab j) (tabje D Wabe) Vab jel = Wa) (Val 8 Ba- 
b j,k,b 


Taking the partial trace on the B system, we have 


tre Map) = 5 Tjk |Ua,b,j,k) (Ua,b,j,k| = Va) (Wal. 
b 


j,k,b 


Suppose we multiply on the left by (v| and on the right by |v), for |v) orthogonal to |=). Then 
the RHS is 0 while the LHS is a sum ) 7, p pjk (V|Ua,b,j,k) |? of nonnegative terms. Hence, each of 
these terms must be zero. Thus, the equation can only hold if all the vectors |u¢,p,j,4) are multiples 
of |tq). This implies that 

Mab = IVa) (wal 8 Ca,b 


for some Ca,» as desired. O 


4.2 Nonlocal games and MIP* 
Now, we augment Definitions 3.3 and 3.4 to allow for provers to share quantum resources. 


Definition 4.5. Given a game Y, a quantum strategy is one in which Alice and Bob are allowed 
to share entanglement but not to communicate. We can model their behavior with the strategy 
S = (p, A, B). Here, 


o Write Ha for Alice’s local Hilbert space and Hpg for Bob’s. Then p is a (possibly entangled) 
state in L(Ha ® HB). 


o The set A contains a matrix A* for each question x and answer a, with the guarantee that 
for each question z, A” := {A7 }a is a POVM. (Likewise for B.) 


Alice and Bob perform their strategy as follows: given question x, Alice performs the POVM 
{Az}, and returns her measurement outcome to the verifier. Bob plays similarly. The value of 
their strategy, denoted valy(S), is the probability that they pass the test, over the randomness in Y 
and in their measurement outcomes. 


valg(S) = E Pr [Alg, (xo, £1, a0, a1) = 1] 
(x0,@1)VAlgg 90,41 
= E `> tr( AZ? @ ATi - p), 


(x0,a1)~Algg adits 


Alga (0,21,@0,a1)=1 
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where in the first line, (a9,a1) is the distribution on answers given questions £o, xı. We write 
val(¥Y) for the infimum of valy(S) over all strategies S. We define value analogously for interactive 
proofs. 
We say that L € MIP% , if there is an quantum interactive proof Y that decides it. This means 
that the following three conditions are true. 
o (Completeness) Suppose input € L. Then there is a quantum strategy for Y with value at 
least c. 


o (Soundness) Suppose input ¢ L. Then every quantum strategy for Y has value at most s. 
o All of Q-length(Y), A-length(Y), Q-time(Y), and A-time(¥Y) are poly(n). 
If c— s is a constant, then we will suppress the dependence on them and just say that L € MIP*. 


Remark 4.6. A game ¥ is symmetric if its distribution on questions treats Alice and Bob sym- 
metrically. In this case, we may assume without loss of generality that Alice and Bob’s strategies 
are also symmetric, i.e. that AZ = B® for all questions x and answers a. This allows us to repre- 
sent their measurements by a single set of matrices M (for which M? = AZ = B®). As a further 
simplification, by applying Naimark’s dilation theorem to Alice and Bob’s strategy we can assume 
that their shared state ~ is pure and their measurements are projectors. 


Occasionally, it will be useful to speak of the distribution over measurement outcomes induced 
by a strategy independently of any particular game. For this, we introduce the notion of a bipartite 
correlation 


Definition 4.7. Given a strategy S = (p, A,B), the bipartite correlation produced by it is the 
function P(a, b|x,y) = tr(AZ @ By - P). 


If two strategies produce the same bipartite correlation, they have the same value for any game 
they are used for. Naimark’s theorem (Theorem 4.1) implies for any strategy S, there exists a 
strategy S’ using only projective measurements that produces the same correlation: 


Corollary 4.8 (Naimark’s theorem for strategies). Suppose {Ma} and {Np} are two POVMs acting 
on the A and B factors of a tensor Hilbert space Ha ® Hp, respectively. Then for any Naimark 
dilation of {Ma} given by projectors M} and an auxiliary state |aux4) € Haux,, and any Naimark 
dilation of {Np} given by projectors Ni, and an auciliary state |auxg) E€ Hauxg, it holds that for 
any bipartite state |p) E HA ® Hp, the post-measurement state after applying M @ N to |W) and 
M' ® N' to |W) ® |auxa) ® |auxg) is the same: 


V Ma8 V Mi |) (| VMB VN, = trauxl( MON) (14) (b|@lauxa) (aux,|@lauxg) (auxp|)(M,@Nj)]- 


Moreover, such dilations exist by Theorem 4.1. As a consequence, M,N and M', N' induce the 
same joint distribution over outcome probabilities: 


(Y| Ma ® M |Y) = ((| 8 lauxa) 8 lauxg)) M; ® Nj(|%h) ® lauxa) ® |auxg)). 


Proof. The existence of such dilations follows immediately from Theorem 4.1. To deduce the equal- 
ity of post-measurement states, we apply Equation (4) twice, and use the fact that the partial trace 
composes, i.e. that traux[|'] = trauxpg [traux4 [:]]- 


traux[(Ma ® Ng) (Ib) (| 8 lauxa) (auxa] ® |auxg) (auxg) (Ma ® N5)] 
= tfauxg [V Ma ® I(T ® Np) |) |auxa) (auxal (4| (T 8 Np))V Ma ® 1] 


= VI 9 MVM. 81 |p) (Y| V Ma @ IVI 8 Np. oO 
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4.3 Pauli matrices and the EPR state 


Over a finite field F, with order q = pt for prime p, the single-qudit Pauli matrices are a set of unitary 
matrices acting on C4. Every Pauli matrix can be uniquely written as a product w*X(x)Z(z), where 
w is the p-th root w = e?7/, and X(x) and Z(z) are the matrices 


X@=—) te); A=} oyu, (6) 
JCF gq JCF gq 
where the arguments x, z are in Fy, tr : Fy — F, is the finite field trace. The set of all Pauli matrices 
form a group, known as the Pauli group or the Weyl-Heisenberg group. For the most part, in this 
paper, it will suffice to consider only the group elements of the form w*X(x) (“X-type” Paulis) 
and Z(z) (“Z-type” Paulis). Elements of the form w*X(x)Z(z) for x,z # 0 are sometimes called 
“Y-type”. 
The eigenvalues of X(x) and Z(z) for all x,z are powers of w, as can be seen from the facts 
X (x)? = Z(z)? = I. Any unitary with this property is known as a (generalized) observable. Every 
generalized observable U induces a projective measurement with p outcomes, corresponding to the 
p possible eigenvalues of U. As a convenient shorthand, we will refer to performing this projective 
measurement as “measuring U.” In the case of of the X and Z operators, the eigenvectors |r} and 
|r) of X(1) and Z(1) are indexed by elements u of F}, with eigenvalue tr[u]; thus, each eigenvalue 
occurs with multiplicity q/p. Explicitly, they are given by 


re) = E Doet, Ira) = lu). (7) 
veFg 


We denote the projectors onto these eigenvectors by 7 and 77, respectively. These eigenvectors 


are also the eigenvectors of the remaining X(x), Z(z) observables, as shown by the following fact. 


Fact 4.9. For W € {X,Z}, the observables W (v) are related to the projectors TW by 
Wo)= > ory (8) 
TW = Bw thw (w). (9) 


Proof. We start with Equation (8). For W = Z, the relation follows immediately from the defini- 
tions. For W = X, by calculation we have: 


Sone — 1 y wtrlwa] ,tr[u(v—v’)| lv’) (v| 


u u,v,v! 


2 > E wit (e+0—-v)] |v’) lo] 


= v +) (o 
= X(e), 


where we have applied Fact 3.1 in passing from the second to the third line. Now we show 
Equation (9): 


Ew "uW (v) -E > ty wel ele wv =E 5. pearl W -_ a 


v 


where we first applied Equation (8) in the first equality, and then used Fact 3.1 to perform the 
expectation over v. oO 
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The Pauli matrices obey the commutation relation 
X(2)Z(z) = w-*41Z(z)X (2). (10) 


This follows directly from Equation (6). It follows from this that all of the Pauli matrices (including 
the Y-type matrices) are generalized observables. 
The maximally entangled state, or EPR state, over qudits of dimension q is the state 


1 
|EPRq) = Vig lu) @ |u). 


We will write |EPRẹọ) for |EPR4) ©" This state obeys the stabilizer relations 


X(x) 8 X(x)|EPR,) = Z(z) ® Z(—z) |EPR,) = |EPR,) (11) 

TŽ Q I|EPR,) = I @ 7%, |EPR,) (12) 

T @I\|EPRy) = I @ 77 |EPR,). (13) 

Relations (12) and (13) imply that measuring X(x) on both halves of an EPR state will yield two 

outcomes a,b satisfying a = —b, and measuring Z(z) on both halves will yield two outcomes a, b 
that are equal. 

In the important special case of finite fields with characteristic 2 (i.e. Fy for even q), u = —u 


for all u € Fy, and thus measuring any of the X and Z operators on both sides of the state will 
always yield the same outcome. 


4.4 State dependent distances 


In this section, we introduce two state-dependent distances. To motivate them, we first define the 
consistency game, perhaps the simplest nontrivial two-player game. 


Definition 4.10. The consistency game with question x, denoted Yon(x) is defined as follows. 
The question x is given to Alice and Bob, who respond with answers a and a’, respectively. The 
verifier accepts if a = a’. 


We will typically play the consistency game when x, rather than being a fixed question, is 
drawn from some distribution. Our first state-dependent distance quantifies the players‘ success 
probability in this case. 


Definition 4.11. Let {A7} and {B7} be sets of matrices in £(H4) and L(HpB), respectively. Let D 
be a distribution on questions x and |y) be a state in HA ® Hg. Consider the game in which the 
verifier selects x ~ D and then plays %on(a). We say that 


Az ® IBob 6 Iaiice 9 By 


on state |Y) and distribution D if Alice and Bob win with probability 1 — O(ô) using the measure- 
ments A and B, respectively. 


We will sometimes leave the state or distribution unspecified, as they are often clear from 
context. This distance has a clear operational interpretation. Our second state-dependent distance, 
defined next, is more analytic. 
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Definition 4.12. Let {Q7} and {R*} be sets of matrices in L(H). Let D be a distribution on the 
variables x and |W) be a state in H. Then we say that QZ ~5 RZ on state |p) and distribution D if 


By MQ? - RE) Iv) |? = 006). 


As above, we will sometimes leave the state or distribution unspecified when clear from context. 
This is sometimes referred to as the state-dependence distance, whereas our first distance measure 
is often referred to as the “consistency”. A typical setting of parameters is H = Hy 8 Hp, 
Q? := A? Q Ibob, and RZ := Inice ® BZ. In this case, we have the following relationship between 
the two state-dependent distances. 


Fact 4.13. Let {A7} and {B2} be POVM measurements. The following two facts hold. 
1. If AZ ® Ibob 6 Iatice D BG then AG Q Ipob %5 Ialice ® Bz. 


2. If AZ Ibob %6 Imice® B? and {A*} and {B*} are projective measurements, then A* @ Ipob “5 
Iatice @ BE. 


Proof. Suppose that A? ® Ipob ~5 IAlice ® BY. This is equivalent to the statement 
E) (V| At @ Bg |b) > 1- O(ô). (14) 
T 
a 


As a result, using the fact that A and B are POVMs, 
EJ, (AP @ I - 1 8 Bẹ) |4) |? = EJ (l (AZ)? @ I+ 1 @ (BZ)? — 247 @ Bz) W) 


SE) (b| (AP @I+1@ Be — 247 8 Bg) |) (15) 
=2- 2E) (V| A? @ Bẹ |4). 


By Equation (14), this is O(6). As a result, AZ @ Ipob %5 Inlice 9 BZ. The reverse statement holds 
when A and B are projective measurements because Equation (15) is an equality in this case. O 


The following fact shows that we can derive a weaker converse in the case when only one of A 
or B is projective. 


Fact 4.14. Suppose {A7} and {B*} are two measurements such that A? ® Ipoh %5 Inlice 8 BZ. 
Suppose further that either A or B is a projective measurement (and the other is a POVM mea- 
surement). Then AZ ® Ipob ~51/2 Inlice Q BZ. 


Proof. Our goal is to upper bound the expression 


1-E) | (| Az SB |). (16) 


We begin by rewriting the number 1. Here we use the fact that because A is projective, (A%)? = A®, 
and so $` (A2)? = I. This gives us: 


(16) = EJ, (| (AZ)? ® Bob |) — EJ, (Y| Ag ® Ba lW) 
= EJ, (Y| (AG 8 IBob) : (AG 8 IBob — Ialice @ BE’) |W) 


< E>. Az 8 Ipob |4) ||- CAG 8 Bob — Taice 8 Ba) IW) |l (17) 
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Now we apply Cauchy-Schwarz and then Jensen’s inequality: 


(17) <, [ES IAE 8 Ipob |) ||? $ IAF 8 Teo» — Taice @ BE) |) ||? 


The first of these terms we bound by 1, and the second is O(6) by assumption. O 


Remark 4.15. We note that the requirement in Fact 4.14 that one of the two measurements be 
projective is necessary. Consider the measurements {A7} and {B7} with m separate outcomes a 
in which A? = B® = I/m for all x and a. Then A? ® Ipob %0 Inlice ® BZ, but as m — oo, 


1- EX (|47 @ Bz lY) > 1. 


Thus, when one of the measurements is projective, the “~s” distance is roughly equivalent to 
the “~” distance, up to a polynomial factor (which we can tolerate losing in our proofs). More 
generally, however, the “%5” distance can be viewed as a weakening of the “~” distance. In spite 
of this, we will spend much of the paper dealing with the “~s” distance, as it is easier to manipulate 
but still strong enough to reach our desired consequences. (See [Vid11, Section 2.3.1] for a further 
defense of this distance.) We note that even when |Y} is a bipartite state, the “~s” distance is 
defined for matrices Q and R which are not necessarily tensor products over the bipartition. Such 
matrices will often be useful to pass through during intermediate steps of our proofs. 

A common use case for these distances is when the verifier (i) samples a pair of questions £ = 
(ao, 21), (ii) hands ap to Alice and a; second to Bob, (iii) receives their answers ag and a; and 
(iv) accepts if f(x,@o) = g(x,a1) for some functions f and g. Write {AZ°}a, and {B3} }a, for 
Alice and Bob’s measurements, respectively. We can view these as measurements which receive 
the pair (a, xı) and simply ignore one coordinate. Suppose the verifier accepts with probability 
1— 6. Using Notation 4.3, we can view this as performing the consistency game between the 


measurements Arr æa) and Biia) Hence, we can derive the following two facts: 


A? 


[f (z,a0)= 


y © TBob ~5 Taice B Bfaa=a and Alfle,a)=t) ® TBob ~6 Taice © Bfe, a =t] 


This generic format will be the most common use of these notations. 

Remark 4.15 highlights the importance of projective measurements when dealing with the “~s” 
distance. This, and several other key facts about the “5” distance, are true only for projective 
measurements. As a result, we will sometimes apply Naimark’s theorem (Theorem 4.1) during our 
proofs to “round” POVM measurements into projective measurements. However, there is a subtlety 
in doing so, namely that because Naimark’s theorem preserves measurement outcomes, any “~s” 
statements we have derived about our measurement operators will remain true, but Naimark’s 
theorem is not guaranteed to preserve “5” statements. In this work, we will be able to dispense 
with this subtlety and assume all “~s” statements are preserved, because all “~5” statements in 
our proofs will be derived from “~” statements, and so they will remain true after performing 
Naimark’s theorem, since we could simply rederive them. 


7 


4.5 Miscellaneous properties of the state-dependent distances 


In this section, we record some facts about the “5” notation which we will use repeatedly through- 
out the paper. A good rule of thumb is that everything one expects to be true about the “5” 
notation actually is true, except for those things which are not. As a result, we will be overly 
pedantic in this section in order to call attention to these cases. 
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4.5.1 Simple state-dependent distance facts 


Fact 4.16. For two vectors |41) ,|¥2), || l1) + 2) I? < 2I l1) I? + 2 12) I. 
Fact 4.17. Let {Aa} be a measurement. Then 


do lAa 1) IP < Ih) IP. 


Proof. If {Aq} is a measurement, then 


da lá lW) I? = DAs Aa |) (WI) < tr(Z - 1) (I) = II be) P- O 


Fact 4.18. Let {Aa}, {Ba} be measurements. Then for any state |v), 


Yo (a = Ba) IW) I? < 4- I1) I. 


Proof. By Fact 4.16, 
2 A Ba) I6) |? < 295 Ae lo) I? +295 Ba bo) IP 


The fact now follows from Fact 4.17. O 
Fact 4.19. Let {A73} and {B3} be POVM measurements. Then AZ = Bi. 


Fact 4.20. Let {A2} and {B7} be matrices. Let {C/} be matrices such that X (C#)'C? < I for 
all y. (This includes the case when {C} } form projective or POVM measurements.) Then 


At ~s BZ implies CY At ~s CY BZ. 
Proof. Fix questions x,y and answers a. Because of our property on {C} Yo, 


XO I(CYAz — CY Ba) lv) I? = So Wl (Aa — Ba) (CP (CR) (AS — Ba) Id) 


b b 
< (| (Ag — Ba) (Aa — Ba) |b) = I(43 — Ba) 14) II? 


We can therefore derive our desired conclusion: 


E JO ICHAR - CP BE) |v) |? < BY (AE — BE) WW) |? = 6 . 
: a,b MT 


Fact 4.21. Let D,D’ be two distributions such that dry(D,D') < e. Let {A™} and {B7} be 
measurements, and suppose A? ~5 B? with respect to D. Then A? ~s} B® with respect to D'. 


Proof. By the definition of total variation distance, for any set of numbers {vz} satisfying 0 < Vz < 
c, the expectations under the two distributions are similar: 


E — E <c-e€. 
| Eel — BE [all Sc-e 


We will take for our numbers vs = ©, ||(A% — B®) |) ||?, which is always less than 4 by Fact 4.18. 
As a result, 


E < „E Vg + 4e < ô + 4e. 
a2~D! 


This is O( + €), which proves the fact. O 
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Fact 4.22. Suppose A? ~5 B? on state |), and suppose || |Y) — |Y) ||? < e. Then A? %54 B? on 
state |W). 


Proof. Applying Fact 4.16 to (AZ — B®) |) and (A? — B®)(|%) — |w)), 


„E p2 M (Ag = Bz) IW) |’ < E p2 M (Ag — Ba) |v) | + E pa IAs -= BEN) — IP. 


The first of these is bounded by O(6) by the assumption, and the second of these is bounded by 4e 
by the assumption and Fact 4.18. O 


Fact 4.23. Suppose At! ~5 Ba! with respect to a distribution Dmargin on x1. Let D be a distribution 
on (%1,%2) such that the marginal distribution on xı is Dmargin. Then At) ~ Bi) with respect 
to D. 


Proof. This is a simple calculation involving Notation 4.3. O 
Fact 4.24. Let k be a constant, and consider distributions over questions D1,..., Dk. Let D be 
a mixture of these distributions, meaning that there is a probability distribution p = (pı,..., pp) 


such that a draw from D can be simulated as follows: draw i ~ p and output x sampled from Dj. 
Suppose AZ ~5 B? with respect to D;, for alli € |k]. Then AZ ~5 BZ with respect to D. 


Proof. By definition, for each 7 € [k] there is some constant C; such that 
Dall IAP — BY) |) |? < Cx 6. 
oe 


Then we can bound the mixture with 


„E >D (Ag — By) |v) |? = > l(a — By) MIP < E Ci; -ð < max{C;} -8 = O(ô). O 


on 


Fact 4.25. Suppose {A7} is a projective measurement and {B*} is a set of matrices such that 
each B® is positive semidefinite and X, BE < I. Define C3 such that for each x, there exists an a 
such that C3 := B? + (I — Xx BZ) and for all other a’ # a, CZ, := Bt. Thus, C” is a POVM for 
each x. If AZ =, B3 then AZ x% ajo C2. 


Proof. By Fact 4.16, 
ED ag — Ca) |b) IPS 2B DNAs — Bg) |p) ||? + 2E |Z -È Ba) ) lW) I’. 


The first of these terms we can bound by O(e). As for the second, 
B||(Z ~ 2 Be) lv) I? = ne Bay lY) <E ~ Ba) Iw) 
=1- EŬ (| B? l4) < 1- BY (vi (B2)? IW) . 


Now, we write 1 = Ey >>, (4| (42)? |Y), which holds because A is a projective measurement. We 
bound the result as follows. 


EX (| (47)? — (B7)’) Y) = e(ey (Y| (Ag + Ba) (Aa - 25) 


<E ml (Az + Be) |) |[2- 2 NAg = Be) |) |P. 
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For each x, we can bound the first square root by O(1) due to Fact 4.16 and Fact 4.17. Having 
done so, we can move the expectation into the second square root by Jensen’s inequality. The result 
is O(e!/?) by assumption. This proves the fact. o 


4.5.2 Data processing 


e 


In this section, we show a simple data processing inequality for the “~s” distance. We also observe 


that one does not hold for the “~s” distance. 
Fact 4.26. Suppose that AZ © Igob %6 Ialice © BZ. Then Alf (a)=0) ® Ipob 5 Iice Q Brazo): 


Proof. Given question æ, if Alice and Bob return a and a’ in which a = a’, then f(a) = f(a’). As 
a result, applying f to their answers cannot decrease the probability they agree. O 


Remark 4.27. We note that the same fact is not true for the “xs” distance. Consider answers 
of the form a = (b,i), where b € {0,1} and i € [m]. Suppose Aj; = I/(2m) for all a, whereas 
Bg, =1/m and BY; = 0 for all i. Consider the function f(b, i) = b. It can be checked that in this 
case, AZ ® IBob ©1/2m Talice 9 Bg but Afs(q)—p 2 TBob 1/2 Lalice ® Bye (a)=1): 


4.5.3 Triangle inequalities 
In this section, we give two triangle inequalities. Our first is for the state-dependent distance. 
Fact 4.28 (Triangle inequality). Suppose AZ ~5 B? and Bt =, CZ. Then AZ %514. CZ. 
Proof. Applying Fact 4.16 to (A? — B®) |y) and (Bz — C72) lW), 
By DAE -CD IF <2 B MAG — Ba) IW) +2 E BE -CD WI 
a 
< 2(6 + 5. oO 
Note that this does not show that if 
Aa ® Ipob %5 Taice © Ba and By ® Ipob %5 Ialice @ Ca 


then AZ @Ipob %5 Taice C7. This would only follow if, for example, we also knew that D* @ Ipob %6 
I lice ® DZ, for D equal to one of A, B, or C. We do, however, always have the following triangle-like 
inequalities. 


Fact 4.29 (Triangle-like inequalities). The following two facts are true. 


1. Suppose Aŭ ® Ipob ~5 alice 9 Ba; Ba 8 IBob ~5 Inlice @ Cg, and Cy 8 Ipob ~5 Iaiice @ D3. 
Then AZ ® Ipob ~6 Iatice @ DG. 


2. Suppose Az Q Ipob %5 Taice ® Ba, Ba ® Ipob S6 Talice 8 Ca, and Cg ® IBob *65 Iatice 8 Da- 
Then AG ® Ipob ©6 Lalice 9 DG- 


Before proving this, we need the following fact from linear algebra. 


Fact 4.30. Suppose 0 < A,B,C,D < I. Then 


1- |48 Did) < 1 - WH A® Bly) +0- WBS Cih) ta- WIC S Diy)). 
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Proof. Rearranging, we want to show that 
AS Bly) + (b| B@C |p) + YC @ Dy) — | A® Dy) < 2. 


Or, equivalently 
tr(|b) Y|: (A®@B+B@C+C®D—A®@D)) <2. 


The left-hand side is at most the maximum eigenvalue f A® B+ B@®C+C8D-A®D. To 
bound this maximum eigenvalue, we note that A® Bx A@I,BECxI@I,andC@DXxI@D. 
As a result, 


A®B+B@C+C@QD-A®DXAGBIF+I@OI+I®D—-ABQD. 
Next, 1® D—A® D=(I—A)®DX (I—A)@I because A < I. Thus, 
A®I+I@I+I1@D-A®DXAGI+I190I+(-A)Q@l=2-1QT. 
But the maximum eigenvalue of this is 2. O 
Now we prove Fact 4.29. 


Proof of Fact 4.29. The second fact follows from several applications of Fact 4.28. As for the first 
fact, we can write the consistency as 


E) (1- (Y| A? 8 Di |¥)) 
a 
Applying Fact 4.30, this is at most 


E) (1- (VA? 8 Bẹ |b) + (1 — (| BE 8 CF lW)) + (1 — (WIC? 8 DF W) 


Averaging over questions and summing over answers, each of these terms is at most 6, by assump- 
tion. O 


4.5.4 Close strategies have close game values 


In this section, we will show that two strategies which are close in state-dependent distance are also 
close in value for any game 9. We note crucially that one of the two strategies must be projective 
to apply this fact. 


Fact 4.31. Let D be a distribution on questions x, and for each x let acc(x) be a set of “accepting” 
answers. Given a state y and a strategy {A*} define 


val(A) = „E bs (y| Az |v) - 


a€acc(x) 


Suppose {A*} and {B*} are two strategies such that AZ ~5; B® on state w and distribution D. 
Suppose further that either A or B is a projective measurement (and the other is a POVM mea- 


surement). Then 
val(A) — O(6'/2) < val(B) < val(A) + O(6"/?). 
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Proof. Assume without loss of generality that A is a projective measurement and B is a POVM 
measurement. We will prove the fact by showing the following stronger statement: for each x, 
let S(x) be any set of answers a, and define 


val(A,S):=E $ (| Az |). 
a€S(x) 
Then val(A,S) < val(B,S) + O(5'/?). By taking S(x) := acc(x) this implies the lower bound 
val(A) — O(6'/2) < val(B), and by taking S(x) := rej(x), defined to be the set of answers not in 
acc(x), then this implies the upper bound val(B) < val(A) + O(6!/2). 
If we write |u2) = AZ |y) and |w2) = (B® — AZ) |}, then 
[Be 14) 1? = | lua) + lva) I? = II lua) I + Il lwa) (I? + (ua | wa) + (wa | ua) - 
By definition, 
val(B)=E J (WB? |v) 


a€S(a) 


>E B (p| (B®)? l) (because B is a POVM) 
acS(æ) 


=E > B2 W)? 


ac€S(x) 


=E $ lua? + ll we) |? + (ud | wi) + (wit | uz). 
acS(ax) 


Averaging over questions and summing over answers, the first term is exactly val(A) because A is 
projective. The second term is always nonnegative, so we lower bound it by zero. As for the last 
two terms, 

(ug | wa) + (we | Ua) Z —2-| (ua | wa) | = —2- [wall Iwa ll: (18) 


Applying Cauchy-Schwarz, Jensen’s inequality, and Fact 4.17, 


ED [uel ez <B [5 e 5 lles E ST wz i2. a9 
a€S(x) a€S(x) a€S(x) a€S(x) 


But the expectation inside the root is at most O(d) because AZ +5 BZ. Combining Equations (18) 
and (19) completes the proof. O 


We will typically, though not always, apply Fact 4.31 in the following special case. 


Fact 4.32. Let Y be a game whose questions (x1,£2) ~ Y have marginal distribution xı ~ D. 
Suppose {A7} and {B7} are measurements such that AZQI %5 BZQI on state w and distribution D. 
Consider the strategies Sa = {w, A} and Sg = {4, B}. If either A or B is a projective measurement 
(and the other is a POVM measurement), then 


valy (S4) — O(5"/) < valg (Sg) < valy(Sa) + O(6"”). 
Proof. First, we observe that 
Aa ® AG? S5 Aa D BG? ~s Bar Q Baz 


by Fact 4.20. The result follows by applying Fact 4.32 with “A” set to Ag! @ A32, “B” set to 
Bu ® Bi, and “D” set to the distribution on (æ1, %2). We note that “val(A)” there is equal to 


a2? 


valg(S,4) here and “val(B)” there is equal to valg (Spg) here. oO 
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4.5.5 Generating new measurements 


In this section, we show how to combine multiple measurements into a single measurement by 
“sandwiching” them together. 


Fact 4.33. Let k > 0 be a constant. Let {A;a} be a projective measurement. For each 
1<i<k, let {(Bj)i,} be a projective measurement, and suppose that 


(Aa, Alice 8 IBob ~5 IAlice Q ((Bi)G; ) Bob- (20) 


Define the POVM measurement { Jj, gp} 45 


Jia = (Br)ay*** (Ba)az * (Bua * (Ba)aa 0 (Bray: 
Then 
(Aa ,...ap Alice ® IBob 51/2 Talice © (Jai ,...,a )Bob- 


Proof. For each 1 <i < k, Equation (20) implies that 


(AG, Alice 8 IBob %5 Iatice Q ((Bi)G, ) Bob: 
Now, we repeatedly apply this using Fact 4.20: 


(Aii... ap )Alice &® IBob = (Aa, bea Aaz è Aa š Aaz a Aa; )Alice (0S) IBob 
xs (AG, +++ Aa, + Aa, + Aa ++ Aaga Alice 8 ((Br a, )Bob 


S5 Taice 8 ((Ba)a, +++ (Badan © (Biya, + (Badan ++ (Br Yap )Bob 
= Iplice 8 (Sa)... ) Bob: 


The fact now follows from Fact 4.14 and the fact that A is a projective measurement. O 


Next, we extend Fact 4.33 to the case of polynomial measurements (see Section 4.7 below). 
These are structured measurements in which the prover returns the evaluation of a function sampled 
independently from their input. The goal is to retain this structure even after “sandwiching” them 
together. 


Fact 4.34. Let k > 0 be a constant. Let D be a distribution on questions x € X. For each 
1<i< k, let G; be a set of functions gi : X > Ri. and let {Gi} be a projective measurement with 
outcomes from this set. Suppose that the set Gi has the following distance property: for any two 
nonequal gi, g. € Gi, the probability that g;(a) = gi(x), over a random x ~ D, is at most e. 

Let {Agg} be a projective measurement with outcomes gi E€ Fi. For each 1 < i< k, suppose 
that 


(Aig.(x)=a;] Alice @ IBob 6 Talice @ (Ggi()=a;])Bob- (21) 
Define the POVM measurement {Jq,,....9, + as 


a— k KRUR 2 . 1 . 2 eee k 
F640: = Go, Ga Go, Co Gor 


Then 
(Algı (2),...,g(£)=a1,...ap] Alize ® IBob ~(6+e)1/2 Talice 8 (Jigi (2),....9p(£)=a1,...,ap]]Bob- 
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Proof. Let 1 < i < k. By Equation (21), if Alice measures with A, producing g;, and Bob measures 
with G", producing g’, then the probability that g;(a) 4 g(x) is O(5). Write 7 for the probability 
that g; # g;. Then we have the expression 77 - (1 — e) < O(6) or, equivalently, n < O(6/(1 — €)). 
When e < 1/2, this gives the bound 7 < O(6), and when e > 1/2, we have the trivial bound 
n < O(e). As a result, n = O(ô + €). 
In conclusion, 
(Ag, )Alice D IBob “6+ Ialice 8 (GG, )Bob- 


We can now apply Fact 4.33 to Ag, 4, and the G., measurements. It implies that 


(Abi... si) Alice & TBob ~(s-+e)!/2 Talice & (digas Bob- 
The fact now follows from the data processing inequality Fact 4.26. O 


In our next fact, we show that Fact 4.34 holds even when we drop the structured assumption 
on the A matrix. The tradeoff is that we must now assume that the k different measurements act 
on different parts of the input string. In this case, the distance condition becomes slightly more 
cumbersome to state. 


Fact 4.35. Let k > 0 be a constant. Let D be a distribution on questions (£,Y1,..., Yk), where 
each yi E€ Vi. For each 1 < i < k, let Gi be a set of functions gi : Vi > Ry. and let {(Gi)G} 
be a projective measurement with outcomes from this set. (For the i = 1 case, we also allow this 
measurement to be a POVM.) Suppose that the set G; has the following distance property: fix a 
question z = (X,Y1,---,Yi—1, Yitis---,Yk), and let D, be the distribution on y; conditioned on the 
other outcomes z. Then for any two nonequal gi, g: € Gi, the probability that gi(y;) = g;(yY;), over 
a random y; ~ Dz, is at most e€. 

Let {Aa a} be a projective measurement with outcomes gi € F;. For each 1 < i < k, 
suppose that 


(Aa; )atice @ IBob ~5 Taice Q ((Gi) ig, (y;)=a;]) Bob: (22) 
Suppose also that 
Cee a ) Alice Q IBob xs LT Alice &® (a gF ) Bob: (23) 
Define the POVM measurement {J5 g,} 8 
Jagr = (Cr)g Gps (Ci) V2) gs Gal, 
Then 
(Aai iag" )Alice Q IBob ~poly(é,e) Alice (Jiga (y1)o..9% (Ye) <a1 yy] Bob: 
Proof. First, we show how to reduce this to the k = 2 case. Then we prove it for that case. Assume 
the fact holds when k = 2. Define the POVM measurement {(Ji)¢, 4, } aS 


(Hgg = (C) (Gales (Cg * (Gale (Gag, 
We will show by induction that 


(Azi ia" )Alice 8 IBob ~poly(é,e) Zatice @ ((Ji Viga (y1),-.:9%(ys)=01 ,-..,a] Bob» (24) 


the base case being trivial. Assume this holds for i. We apply the k = 2 case as follows: consider 
the question tuple (y1,...,y;) as a single question and consider functions of the form (y1,...,y;) = 
(gi(yi),---,9i(yi)). Then the first POVM measurement is J;, which satisfies Equation (22) due to 
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Equation (24). The second measurement is the projector G41. Then the k = 2 case immediately 
implies the i+ 1 case of Equation (24). 
Now we prove the k = 2 case. Our goal is to show that 


ig es > WA og ) Alice 8 (G2) “(Giir =a] ` (G2)32)Bob KO) (25) 


a1,92(Y2) 
1,92 


is at least 1 — poly(ô, €). We will do this by showing that 


((G1)igi (yx)=ar] ` (G2) G0 )Alice ® Bob *poly(6,e) ((G2) 0 * (G1) is (yy) =a1] )Alice ® IBob- (26) 


is at most poly(d,¢€). To see that this is sufficient, note that the related expression 


A > (A a ) Alice 8 ((Ga)g. ` (G2)g> ° (G1 Jigs (y,)=a1]) Bob |) 


a1,92(y2) 
1,92 


is exactly equal to 1 because G2 is a projector. Taking the difference between this and Equation (25), 
we get 


mE, De (UI Aree Jaic ® (G28 CCDE] (022 — (Ga) * (Caton )=a11))Bob 10) - 


a1,92(Y2) 
@1,92 


Cauchy-Schwarz allows us to bound this by 


Ae alice @ ((G2)%)Bob 14) II? 


Tag Pan a 92(Y2) 


De Marice 8 (C), tu)" (Gade — (Gadi (CDa yy ar) 80% l0) IP. 


a1,g2 


The expression inside the first square root is always at most 1. This allows us to bring the expecta- 
tion into the second square root by Jensen’s inequality, and the resulting expression we can bound 
due to Equation (26). 

Now we bound Equation (26). Showing this is small is equivalent to showing 


x cae ds ICG iau)" (C2)g2 — (G2)go ` (G1)ign (y,)=ar])Alice B TBob |Y) I 
1,92 


is small. Expanding this, we get 


Ep 2 W(t (Vina =a" (Giora) (G2) 2 Bob 


a1,92 
HACinwg=] - (G2)g (Ga) oo ° (G1 )ios(y1)=ar] 8 IBob 
—(G2)G0 ` (Gr) E61 (y,)=a1] ` (G2) G0 * (G1) fr (yy) =a1) 8 Bob 
(Ga) (y1)=a1] ` (Go) 50 ` (Gi) (y )=a1] ` (Ga) oo ® TBob) lb) : (27) 


We do know that G1 and G2 satisfy some form of commutation. Because they satisfy Equation (22) 
and A is a projector, we know that 


(CG) fon (ys)=ar] * (G2) iga(y2)=aa])Alice B IBob “5 ((G2)igo(ys)=az] * (G1) ign (ys)=a1}) Alice 8 Bob- 
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Expanding this as above, we can bound the following expression by 6: 


wey, 2 Wl ((GaMibatue)=aa} (CDi CDi w)=01 * (G2) foa(n)=aa) 2 Tob 


1,42 
FGiodtoya] Cata Cia ea * (G1)i61 (y,)=a1] @ Bob 
—(Ga2) isa] * (G1) fon (y,)=ar] Ciwa Cna] © Bob 
(Gi) iptuyaiy? Cewa CVa * (G2) (gat, fas] © Tae) |e) B3) 


We can therefore show Equation (27) is small by upper-bounding (Equation (27)—Equation (28)). 
There are four terms in this difference; write A; for the i-th term in Equation (27) minus the i-th 
term in Equation (28). We will bound each A; one-by-one. 

The first term in the difference, Aj, is 


El (G2) (CDa) (CDa) (C2) ® Tob |) 


@,Y15Y2 ai g2 


- peg, De O Gitu) (CDi CDa)" (G2) foa(as}=aa) 2 TBob I) - 


a1 ,a2 


The first of these terms is at most 1, and so we just have to show that the second term is close to 1 
as well. Note that by repeated applications of Equation (22), we have that 


ax Ba ax x ag . zT,Y1:Y 
(Gisatua j=aa] © (G1) for (yy)=ar} © (G1) fos (yy)=ar} C2) Bob Sa Taie @ Aanas 


But then by Fact 4.31, the expression we want to lower-bound is O(6'/ ?)-close to 


E XO (bl Iai ® Agta”? |W) , 
@,Y1,Y2 1,02 


which is exactly 1. As a result, A; is at most O(6!/2). 
The second term in the difference, A2, can be written as 


-ES > (bl ((G1) ia (y,)aar} © (G2)go (C27 (G1) guy) =a1} 8 Bo) |) - 
ay 9249), 
92(Y2)=92 (Ya) 


This is zero because G2 is a projector. 

The third and fourth terms in Equation (27) are complex conjugates of each other, as are the 
third and fourth terms in Equation (28). As a result, it suffices to bound the magnitude of Ay, and 
this will serve to bound Ag as well. We begin by manipulating the fourth term in Equation (27); 
specifically, we will show that it is close to 


a a D WI Giot )=a1] * (G2)o2 (G1)ioi tu )=a1] © (G2) |) - (29) 
a1,92 
To do so, we take their difference: 


rE 2 OUDE (CD Cauza] 2 To) 


1,92 


- (Ialice ® (G2)G — (G2) Q IBob) |v) - 
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To bound the magnitude, we apply Cauchy-Schwarz: 


DO WM(Gr YF sey yaar) (C)B (GDE, y,)=a1] @ TBob) 14) |? 


@1,91 


z i 
> IG) tei =an ® Ipob) + alice @ (G2)2, — (G2)%, Q Bob) |v) ||. 
@a1,91 


The expression inside the first square root is always at most 1. This allows us to bring the expec- 
tation into the second square root by Jensen’s inequality. Because G1 is a POVM, we can bound 
the resulting expectation by 


aE, 2 Illai 8 (G2)3, — (Ga) 2 Fob) |Y) IP. (30) 
gı 


To bound this, we note that Equations (22) and (23) along with Fact 4.29 imply that 


(G2) igo(y2)=a2] © TBob ~5 TBob ® (G2)i90(y2)=a2)° 


Using the distance properties of Gz, this implies that 
(G2)5. ® IBob ~s+e Bob ® (G2)6, 


Hence, Equation (30) is at most O((6 + €)!/?). A similar argument shows that the fourth term in 
Equation (28) is O(6'/2)-close to 


= > Wien wean Caoa aaa Opie) “CY 


LY Yo 
a1,a2 
Now, we compute Equation (29) minus Equation (31): 


E S, dS Guwa (C (hua Ca IY) 
ai 92,95 


g2(Y2)#93(Y2) 
F E Yz > a (y| (G 1)ig (yı)=a1] ` (Go), AGI) tpl ay] @ (G2)7, lh) ` 1(92, 95, Y2), 


a1 92,95 


where 1(92, 95, Y2) is the indicator that g2 4 gh but go(y2) = 94(y2). This is the only part of the 
expression that depends on yy, and by our distance assumption it is at most € in expectation. Since 
the rest of the expression is guaranteed to be positive, we can upper-bound this by 


2 2 Cl Gdin] (Gaga (C) =a] © (Gade, I) € 
A 92,93 


But the remaining part of the expression is at most 1, and so in total we can upper-bound it by e. 
This completes the proof. O 
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4.6 Commuting EPR strategies 


In this section, we introduce a class of strategies important for our proof. 


Definition 4.36. A strategy S = (y, M) is called an EPR strategy if it satisfies the following two 
properties. First, there is an integer k and powers of two qi,...,q, such that 


Ip) = [EPR4) & |EPR,,) @---@ |EPRq,) : 


Second, for each question x, M7 is a projective measurement. If for all questions x and answers a, 
MZ is a real-valued matrix, we say that the strategy is real 

In addition, given a game Y, we say that a real EPR strategy S is a real commuting EPR strategy 
(with respect to Y) if for every (x1, x2) in the support of S and every a1, a2, M7! commutes with 
M2. We denote the set of real commuting EPR strategies by ComEPR(¥). 


Real commuting EPR strategies are motivated by the completeness cases that arise in this work. 
We give a series of transformations which modify games to make them sound against increasingly 
broader sets of strategies. Unfortunately, these transformations are not complete for all strategies, 
in the sense that value-1 strategies may be mapped to value-less-than-1 strategies, but we will be 
careful to ensure that they are complete for all commuting EPR strategies. For the majority of the 
paper, the one property of commuting EPR strategies that we will use, not shared by all value-1 
strategies, is the following. 


Fact 4.37. Let (Y, M) be a real EPR strategy. Then M? ®Ipob ~0 IMice® ME for every distribution 
on x. 


Proof. From the definition of EPR strategies, we know that |y) = |EPRy,) ®... ® |EPRg,) € 
(CM-92"""%)®2 We may choose a basis {|i): 1 <i < q1-qo-----qg} for C274, so that 


IW) = 2; |?) alice @ |?) Bob $ 


Let us denote the components of M7 by the notation (Mg )ij, so that Mg = Xy; (Mê )ij li) (Jl. 
Now, for an arbitrary pair z,a, we can compute the post-measurement states from applying MẸ 
on Alice’s and Bob’s systems. 


Mz 8 Teo |Y) = (Ma ® Teo) X li) Alice @ li) Bob 
= > Ma) l) ® |j) 
ij 
= > (Ma) li) @ |) 
= Tanas ® Ma) lW), 


where in going from the second to the third line, we have used the fact that MẸ is real and 
Hermitian, and thus symmetric. O 


The following fact is a useful special case. 


Fact 4.38. Letn>0, q=2', and W €{X,Z}. Then T @I x01 @7! on the state |[EPR). 
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Proof. By Equation (7), we can write 


ele), tee) =). 


Vd OG, 


The second of these self-evidently has real-valued coefficients. As for the first, q = 2° implies that 
p= 2. This means that w = —1 and tr[uv] € {0,1} for all u,v. As a result, it too has real-valued 
coefficients. The fact then follows from Fact 4.37. O 


This property of real commuting strategies is useful for answer reduction because it allows us to 
perform oracularization, giving one prover both questions x; and x2 so that they may simulate the 
action of both provers by simultaneously measuring M*! and M*?. For more details, see Part V. 


4.7 Quantum soundness of the classical low-degree test 


An important tool for quantum protocols is a version of the Raz-Safra theorem (Theorem 3.12) in 
which the soundness of the low-degree test is extended to hold even in the case when the provers are 
allowed to share entanglement. For the plane-versus-point test, this was first developed by Vidick 
in [Vid16], but for technical reasons he could only show it for the case of three or more quantum 
provers. In [NV18b], this was improved to hold for the two-prover case, and this is the result we 
use in this work. We begin by defining the class of polynomial measurements. 


Definition 4.39. Define PolyMeas(m, d, q) to be the set of POVM measurements whose outcomes 
correspond to degree-d, F,-valued polynomials. In other words, G € PolyMeas(m, d, q) if G = {Gg}, 
with outcomes degree-d E ae g : Fj’ —> Fy. More generally, we let PolyMeas(m, d, q, £) be 
the set of measurements G = {G4 ge} ade £ degree-d polynomials g; : Fj’ > Fy. 


The following theorem establishes the quantum soundness of the classical low-degree test in the 
k = 2 case. 


Theorem 4.40 (Quantum soundness of the classical low-degree test [NV18b, Theorem 2]). There 
exists a constant c > 0 and a function (e) = poly(e,dm/q°) such that the following holds. Suppose 
Alice and Bob are entangled provers who pass Gurface(M, d, q,2) with probability at least 1 — € using 
the strategy (w,M), where M consists of projective measurements. Then there exists a POVM 
measurement G € PolyMeas(m,d,q) such that 


My’ ® IBob ~6(6) alice @ Gfg(w)=0}> Gy ® IBob ~5(c) alice 8 Gg, 
where the first is on the uniform distribution over Fj’. 


Remark 4.41. The statement of Theorem 4.40 is modified from how it appears in [NV18b, The- 
orem 2] to better suit our needs. In this remark, we show how to derive our version from theirs, 
which is stated as follows. 


o There exists a constant c > 0 and a function (€) = poly(e) such that the following holds. Sup- 
pose q > (dm/e)°. Then if Alice and Bob pass the surface-versus-point test with probability 
1 — €, there is a measurement G € PolyMeas(m, d,q) such that 


ED) >, (IMF S Gl) < ale), — D(HIGg@ (I-—Gy)|¥) <4). (32) 
9 fFgls g 
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These are equivalent to the statements 


M? ® Ibob ~6(c) alice @ Gig|e=s]> Gy ® IBob ~5(c) LAlice ® Gg, 


where the first is on the uniform distribution over surface in Ey The second of these matches the 
corresponding statement above. Next, by Fact 4.26 we derive 


MiF(w)=v) 8 Bob ~6(c) Taiice ® Glg(w)=t and — Gig(w)=b] ® IBob ~5(e) Alice 8 Clg(w)=b]: 


with respect to the distribution (s, w) from %urface(m, d,q,2). On top of that, since the strategy 
passes the test with probability 1 — €, 


My ® Ipob =e Iatice @ Mi Fw) =0 
As a result, if we use Fact 4.13 to switch these to “~s” statements, then 
My’ ® Ipob © Taiice © Mip(w) =a Y5(€) G[g(w)=0] ® IBob Sale) Talice @ Gfg(w)=0): 


The result now follows from the triangle inequality (Fact 4.28) followed by Fact 4.14 and the fact 
that M was assumed to be projective. 

Finally, we remove the condition on q using a trick from [NV 18a]. If q < (dm/e)°, then we select 
e > e such that q = (dm/e’)°. Alice and Bob also pass the plane-versus-point test with probability 
1 — e because 1 — €e < 1 —€, and so we can apply the theorem with these parameters, giving 
a robustness of ô(e') = 6(dm/q'/°). (In the case when e > 1, which is not allowed, this bound 
trivially still holds because dm/q!/¢ > 1.) In general, then, we can remove the condition on q so 
long as we replace the robustness of poly(e) with poly(e,dm/q!/°), which holds in both cases. 


We will use the following proposition about polynomial measurements several times. 


Proposition 4.42. Let d > 0 be an integer. Consider a distribution D on pairs (s,u), where s 
is a subspace in Ff’ and u is a uniformly random point in s. Let {M ‘a be a measurement whose 
outcomes are degree-d polynomials f : s —> F}, and let G € PolyMeas(m, d,q). Suppose that 


MF (w=) 8 TBob ~5 Latice @ Gig(u)=0) 


with respect to D. Then 
M? ® IBob ~6-+4/q TAlice ® Gig|.=F] 


with respect to D. 


Proof. Suppose the verifier (i) samples (s,u) ~ D, (ii) gives Alice s, who measures with M* and 
returns her outcome f : s > Fy, (iii) receives g : Fj’ —> F, from Bob, sampled via G, and (iv) 
accepts if f(u) = g(u). Then by assumption, the verifier accepts with probability at least 1— O(ô). 

We can use this to bound the probability that f and g disagree on the subspace s. By Schwartz- 
Zippel (Lemma 3.6), conditioned on f and g disagreeing, the probability they disagree on a random 
point u ~ s is at least 1 — d/q. This gives us the inequality Pr[f 4 g|s| - (1 — d/q) < O(6). Now, 
assume first that q > 2d. Then this bound implies, via Fact 4.13, that 


M? ® IBob ©6+44/q IAlice D Gig|,=F]- (33) 


On the other hand, when q > 2d, then this bound is also true for trivial reasons. This is because 
we can pick 6(-) such that 6(€) > 1 in this case. oO 
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4.8 Quantum soundness of the classical simultaneous low-degree test 


We would now like to use Theorem 4.40 to show quantum soundness for the simultaneous classical 
low-degree test. This will be done using the same reduction presented in Section 3.6. The main 
result is the following. 


Theorem 4.43 (Quantum soundness of the simultaneous classical low-degree test). There exists 
a constant c > 0 and a function 6(€) = poly (e, d(m + £)/q°) such that the following holds. Suppose 
Alice and Bob are entangled provers who pass GE tace M, d,q,2) with probability at least 1 — € using 
the strategy (Y, M), where M consists of projective measurements. Then there exists a measurement 
G € PolyMeas(m, d, q, £) such that 


Myy.....bp 8 IBob ~5(c) Lalice B Gigi (w),...,9e(w)=b1,.--sbe]> Gg1,.. ge © Bob ~5(e) Lalice D Go1,...,905 
where the first is on the uniform distribution over Fj’. 


Proof. Suppose Alice and Bob pass GE atace lM, d,q, 2) with probability at least 1 — e. We will 
use them to simulate two provers, “Combined Alice” and “Combined Bob”, who pass the single- 
function low-degree test Gurface(€+m,d+1,q,2) with probability at least 1— e. They are specified 


as follows: 


o Combined Alice: Given s C ie draw s’ ~g Sproj- Give it to Alice, who responds with 
fi,---,f¢: 8’ + Fy. Output the function combine f]s. 


o Combined Bob: Given (x,y) € ee compute y € Fj". Give it to Bob, who responds with 
b,...,6¢ € Fy. Return combine, (x) € F4. 


By Proposition 3.15, s’ and y are distributed as the questions in Ge pane (Ils Gs Gy 2). Using our 
assumption on Alice and Bob, this means that f(y) = bı, ..., fely) = be with probability 
at least 1 — e. As a result, (combines|,)(@,y) = combinep(y) with probability at least 1 — e. 
By Proposition 3.16, combineş|s is a degree-(d + 1) function on s, and so it is a valid response 
to subspace queries. This means Combined Alice and Bob pass %urface(@ + m,d + 1,q,2) with 
probability at least 1 — e. 
Thus, we can apply Theorem 4.40. It gives a measurement G € PolyMeas(¢ + m,d+ 1,q) such 
that 
Micombines(2)=r] © TBob ~a(c) Taice 8 Gig(xy)=v)1 Gg @ IBob Sifo) Taice D Gy, (34) 


where ô(€) = poly (e€, (d + 1)(€+ m)/q°). This means that if we give Alice y and she returns b, and 
Bob simply returns g, then combines (x) = g(x,y) with probability at least 1 — d(e). 

We would like to show that g is exactly linear in x with high probability, over the randomness 
in the measurement G. Let us condition on a g which is not exactly linear. By Proposition 3.18, 
the probability that g|y is not exactly linear is at least 1 — (d+ 1)/q. On the other hand, because 
combine,(x) is always exactly linear by construction, the probability that g|y(a) = combine,(x) 
is at most (d+ 1)/q by Schwartz-Zippel (Lemma 3.6). As a result, the probability that g(x,y) = 
combinep(a) is at most (d + 1)/q + (d+ 1)/q. Thus, if we write Hinear for the probability that g is 
exactly linear, we have equality at most /ijinear + 2(d + 1)/q fraction of the time. Rearranging, g is 
exactly linear with probability 


Hlinear >1- 26(€) = 2(d + 1)/q. 


Define a new measurement {Hy,,...4,} E PolyMeas(m, d, q, £) operationally as follows: first, mea- 
sure G and receive g. If it is exactly linear, it can be written as `; 2; - g;(y), and so output 
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g1,---,9¢- Ifg is not exactly linear, output any arbitrary degree-d polynomials instead. When g is 
exactly linear, we have combineg, ....,(x,y) = g(x,y). Since this happens with probability at least 
1 — d(€), we can replace G with H in Equation (34), yielding 


M combiney(x)=v] © TBob ~ste) Zalice ® Afcombine, (x,y)=v1> (35) 


On the other hand, because H is just G with data processing applied to its output, we can apply 
Fact 4.26 to Equation (34). This produces the equation 


Fig,,....9¢ 8 IBob ~5(c) Alice © Ayy....,90: 
Consider g4, . . . , gp drawn by Bob using H. For any fixed b and y, if it is not the case that gi(y) = 


bi, .--, gely) = be, then the probability that combineg(x, y) = combine,(x) over a random g is at 
most 1/q by Schwartz-Zippel, since both are exactly linear functions. Thus, if Alice draws bj,..., be 
given y, and we write 7 for the probability that g;(y) = b1, ..., ge(y) = be, then the probability 


that combineg(x, y) = combinep(x) is at most 7+ (1—17)-1/¢. Combined with Equation (35), this 
implies that 

Pri[gi(y) = b1,---,9e(y) = be] > 1 — (6) — 1/4. 
Or, equivalently, 

My. ....b, Q IBob ~5(e) Talice D Giga (y),....9¢(y)=b15--be] o 


4.9 Self-testing 


The games presented in Sections 4.7 and 4.8 might be referred to as “measurement testers”: if a 
strategy passes them with high probability, then we can extract some property on its measurements. 
In this section, we will introduce a significantly stronger notion of testing called self-testing. A self- 
tester is a game in which if a prover passes with high probability, then not only do we do exactly 
which measurements the prover must be performing, we also know which exactly state it must be 
performing them on (up to local isometry). (We note that some works use “self-testing” to refer 
both to “measurement testing” and what we refer to as “self-testing” [NV18a]. In this work, we 
will reserve the term exclusively for the latter.) We begin with a definition. 


Definition 4.44. We say that S = (p, M) is a partial strategy for Y if M contains the POVM M” 
for only a subset of the questions in J. We call this set of questions S’s question set. A strategy 
S' = (w, M') extends S if (M’)* = M” for every x in S’s question set. 


Next, we define self-testing. 


Definition 4.45 (Self-testing). Let S = (y, G) be a partial strategy and D be a distribution over 
its question set. A game @ is a self-test for S over D with robustness 6(e) if it satisfies the following 
two conditions. 


o Completeness: There exists a (full) strategy Stu consistent with S which passes Y with 
probability 1. 


o Soundness: Let S = (y, M) be a strategy which passes ¥ with probability 1— e. Then there 
exists a local isometry $ = local ® Ploca] and a state Jaux) such that 


ll l9) — lY) laux} ||? < 4(e). 
Furthermore, if we define the new matrices M? := local -M - (Piocal)', then 
Mz ® IBob Ss(e) (Ga Q Taux) Q IBob, (36) 
on states |Y) |aux) and |Y’) and distribution æ ~ D. 
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We note that this definition of self-testing differs in several key places from the one given in 
[NV18a, Definition 2.5]. We will explain these differences in more detail when we cite the quantum 
low-degree test in Section 6. 


Part III 
Implementing the registers 


5 Register overview 


In this part, we implement the quantum registers. Our goal is force Alice and Bob to share a state 
of the following form: 


[om [om | s+ [rea | im | @ Laux], 


in which each register r; contains an EPR state, and aux is asymmetric auxiliary state. In addition, 
we want the verifier to be able to (i) force the provers to perform Pauli basis queries on some of these 
registers and report back the outcomes and (ii) “hide” the remaining registers from the provers so 
that they do not measure them at all. 


5.1 Definitions 


In this section, we will begin by defining quantum registers for nonuniform games. Defining registers 
for uniform games @ is a little more complicated because we allow the number and size of registers 
for Y(input) to depend on input. We detail this below in Section 5.3. 


Definition 5.1. Let k > 0 be an integer, and let n = (n1,...,n,) and q = (q1, ---, qk) be k-tuples 
of integers. A (k,n, q)-register game Z is defined as follows. 


o Questions x are formatted into two blocks x = (x1,22). The first block contains a list of k 
Pauli basis queries xı = (Wj,...,W,), where each W; € {X, Z, H, L}. 


o Answers a are formatted into two blocks a = (a1, a2). The first block contains a list of answers 
to the Pauli basis queries a] = (w1,.-., uz). Here each u; € Fj U {Ø}. 


An (k,n, q)-register strategy S is defined as follows. 
o Alice and Bob share a state 
|b) = |r1) 8 -8 |r} Q laux} . 


Here, |r;) = |EPRj') for each 7, and |aux) is an arbitrary symmetric shared state. 


o Given a question x = (21,22) with first block zı = (W1,..., Wẹ), Alice and Bob act as 
follows. Let i € [k]. 


— If W; € {X, Z}, they measure 7 on the i-th EPR register and set u; to be the outcome. 
— If W; € {H, L}, they set u; = Ø. 


Introduce the notation 7” = I for W € {H, L}. We can write their measurement as 


Meare = T Q-Q M Q Laux- (37) 
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To produce the second part of their answer az, Alice and Bob can measure any part of their 
state except the EPR registers which have been “hidden”. This entails the following: let 
S = {i | W; = H}. Then for any answer a, the corresponding POVM acts as follows: 

MZ = Mz@ Is. (38) 
Here, Is is the identity matrix on the EPR registers in S, whereas Mz is a POVM acting on 
the EPR registers in 9 as well as the state |aux). 


We define valk,n (2) to be the maximum over valy(S), where S is any (k,n, q)-register strategy. 


The X and Z questions specify the corresponding Pauli basis measurement, and the H question 
specifies that the register is to be hidden. The L question is a “no-op” and does not restrict Alice 
and Bob at all, other than making them respond with the “no-op” answer @. Thus, unlike with the 
data hiding question, they are allowed to measure the register as they see fit. This will be useful 
later when we want Alice and Bob to measure both X and Z observables on the same register. 

In designing our compiler, it will be convenient to define a set of strategies called “semiregister 
strategies”. These will be strategies which are intermediate between (k — 1)-register strategies and 
k-register strategies in the sense that they have Pauli basis queries implemented on the final (k-th) 
register but not data hiding queries. These are defined as follows. 


Definition 5.2. A (k,n, q)-semiregister strategy is defined just as a (k, n, q)-register strategy, with 
the following modification: the set S used in Equation (38) is changed to be S = {i 4k | W; = H}. 


We define va ae (F) to be the maximum over valy(S), where S is any (k,n, q)-semiregister strategy. 


Thus, querying the k-th register of a semiregister strategy with a H is the same as querying it with 
al. 

The following lemma shows that we can restrict to projective register strategies without loss of 
generality. 


Lemma 5.3. Let S be a (k,n, q)-register strategy. Then there exists a (k,n,q)-register strategy S’ 
in which all measurements are projective, and which produces the same bipartite correlation as S. 


T1,£2 


Proof. Start with the strategy S, and let the measurements be denoted Maraz - From the definition 
of register strategies, we know that for every set of questions 71, £2, the corresponding measurement 
can be written as a product 
Wz 
a @ (Ag, 


a1,a2 


where § is the set of registers which receive a Pauli basis query in the set X,Z,H, S is its com- 
plement, and the operators {Ag3"?""'} form valid POVMs with outcomes az for every choice of 
z1, 22,41. We will apply Naimark’s theorem Theorem 4.1 using the universal auxiliary state |aux) 


to the A operator to produce projectors Aj,!”"?""!. Using these, we define a projective measurement 


Mis = (Ta) @ (Ag) 


a1,a2 


It is not hard to see that M’ and |aux) form a valid Naimark dilation of M. Let S’ be the strategy 
S with the shared state |W) replaced by |) ®@ |aux,) @ |auxg) and the measurements M replaced 
by M’. By construction, S’ is a projective strategy. Further, from Corollary 4.8, it follows that the 
bipartite correlations produced by the strategies S’ and S are the same. O 
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5.2 Results 


The key elements of our compiler are two new nonlocal games called the Pauli basis test and the 
data hiding game. The Pauli basis test ensures that the provers share an EPR state and honestly 
answer Pauli basis queries to this state. The data hiding game allows us to “hide” this state from 
the provers, ensuring that they do not use this register unless we ask them to. 

Our compiler operates a register at a time and involves two subroutines, Ck—semi and Cgemi>h—1- 
Given a k-register game, Ck—semi produces a k-semiregister game. To do so, it removes the guarantee 
that the provers data hide the k-th register and replaces it by playing the data hiding game on this 
register. Thus, although the provers are no longer forced to hide the k-th register, they will have 
to do so anyway if they want to pass the data hiding game. Similarly, given a k-semiregister game, 
Csemi+>k—1 Produces a (k — 1)-register game. To do so, it removes the guarantee that the provers 
have a k-th EPR register and replaces it by playing the Pauli basis test. Thus, by alternating these 
two subroutines, we can compile a k-register game into a 0-register game, i.e. a general game. 

Before giving the properties of the Pauli basis compiler, we will need two definitions. 


Definition 5.4. Given a string x = (x1,..., £k) and an integer 0 < £ < k, write x|¢ := (a1,..., £e). 
We extend this to register parameters T = (k,n,q) by setting Tle := (£, nle,qle). Thus, Tle is the 
register parameters for the first £ registers of T. 


Definition 5.5. Let n and q be integers and 7 be a real number. We say they satisfy the Pauli 
basis condition if 
= 2t 1 


64 log(n)? 
poly(n) 


< ad <q< l 
STS 7 < q < poly(n). 


The following theorem describes the Pauli basis compiler. 


Theorem 5.6. Let A = (k,n,q), and let nk, qk, and n satisfy the Pauli basis condition. Suppose 
Gemi 18 a A-semiregister game, and consider the A|k—1-register game Fy—1 = Csemi+(k—1) (semi). 


o Completeness: Suppose there is a value-1 -semiregister strategy for Gomi which is also a 
real commuting EPR strategy. Then there is a value-1 \|,-1-register strategy for G—1 which 
is also a real commuting EPR strategy. 


o Soundness: If valy, ,(%-1) = 1— € then valS™ (Lemi) > 1 —5(€), where 5(€) = poly (e,n). 


Furthermore, 
Q-time(%_1) = Q-time(Geemi) + O(log(nz)), 
Q-length(Y,_1) = Q-length(Gemi) + O(log(nz)), 
A-time(Y_1) = A-time(Gemi) + poly (ng), 
A-length(G,_1) = A-length(Gemi) + O(nz - log log(nz)). 


The following theorem describes the data hiding compiler. 


Theorem 5.7. Suppose G is a (k,n, q)-register game, and consider the (k,n, q)-semiregister game 


Gi = Ck-ssemi (Gr). 


o Completeness: Suppose there is a value-1 (k,n,q)-register strategy for Iy which is also a 
real commuting EPR strategy. Then there is a value-1 (k,n, q)-semiregister strategy for Gomi 
which is also a real commuting EPR. strategy. 
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o Soundness: If va ree (Heemi) > 1-— e then valk nfk) > 1—4d(e), where (e) = poly(e). 


Furthermore, 
Q-time(Gemi) = O(Q-time(Y)),  A-time(Gemi) = O(A-time(G)), 
Q-length(Gemi) = O(Q-length(G,)), A-length(Gemi) = O(A-length(G,)). 


Combining Theorems 5.6 and 5.7 gives us the main result of Part III, a compiler C which 
compiles k-register games into general games. 


Theorem 5.8. Let % be a (k,n, q)-register game. Letn = (m,..., nk), and suppose ni, qi, and ni 
pass the Pauli basis condition for alli € |k]. Write 


G= C(G) = Creat 3 (Ci—semil Sea Csemi ski (Ci spent (%)))). 


o Completeness: Suppose there is a value-1 (k,n,q)-register strategy for p which is also 
a real commuting EPR strategy. Then there is a real commuting EPR strategy for Y with 
value 1. 


o Soundness: If val(Y) > 1—e then valik nq) (fk) = 1—4(€), where d(€) = poly(e,m,---,k)- 


Furthermore, 
Q-time(Y) = Q-time(G) + O(log(n1)) +--+ + O(log(nx)), 
Q-length(Y) = Q-length(Y,) + O(log(n1)) + --- + O(log(nx)), 
A-time(Y) = A-time(Y,) + poly (n1) +--+ + poly (nk), 
A-length(Y) = A-length(Y,) + O (nı - log log(n1)) + ---O(nx - log log(nx)). 


5.3 Registers for uniform games 


In this section, we generalize the notion of registers to the case of uniform games, in which a 
different set of register parameters might be used for each input. To compile these games, we will 
need for the register parameters themselves to be uniformly generated. 


Definition 5.9. Let Mparams be a Turing machine which, given an input input, outputs A = (k,n, q). 
Let Y be a (nonuniform) game. Then we say Mparams outputs the register parameters of Y if for 
every input, Y(input) is a Mparams(input)-register game. 


Given this, our compiler for uniform games is given as follows. 


Corollary 5.10. Let Y(-) be a (uniform) game, and let MParams be a Turing machine which 
outputs its register parameters. Then there exists a (uniform) game Gcompile(:) with the following 
properties. Given an input input, write Y := Y(input), Yoompile = Ycompile(input), and À = 
(hy 9,0) := Meéarams (input). 


o Completeness: Suppose there is a value-1 (k,n,q)-register strategy for GY which is also a 
real commuting EPR strategy. Then there is a real commuting EPR strategy for compile with 
value 1. 


o Soundness: Let n = (m,..., Ng), and suppose ni, qi, and n; pass the Pauli basis condition 
for alli € |k]. If val(Gcompile) > 1—e€ then val, (J) > 1—d(e), where d(€) = poly(e,m,..-, Nk). 
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Furthermore, 


G 
G 
G 
G 


Q-time 
Q-length 
A-time 
A-length 


= Qtime(Y,) + O(log(n1)) + +++ + O(log(ng)) + time(Mparams(input)), 
= Qlength(Y,) + O(log(n1)) +--+ + O(log(nx)), 

= A-time(Y%) + poly (n1) +--+ + poly (ng) + time(Mparams(input)), 

= A-length(%) + O(n, - log log(n1)) +--+ O(ng - log log(nz)). 


—>—=~ >a > 
Qa Ns Ns N 


Proof. We first compute A = Mparams(input) in time time(Mparams(input)). Then it can be checked 
that the compiled game C(¥(input)) from Theorem 5.8 can be efficiently simulated given the register 
parameters A. oO 
5.4 Organization 
The remainder of Part III is organized as follows. 

e In Section 6, we introduce the Pauli basis self-test and prove its correctness. 

e Section 7 implements the Pauli basis compiler. 

e In Section 8, we introduce the data hiding game. 

e Section 9 implements the data hiding compiler. 


e Section 10 contains a generalization of the data hiding game which allows us to hide more 
general sets of Pauli observables. This is not needed to implement the quantum registers, but 
it will be needed in Part IV when designing the NEEXP protocol. 


6 A self test for the Pauli basis 


In this section, we give a self test for the Pauli basis measurement. Given W € {X, Z}, this test 
compels the prover to measure an EPR register in the W basis and return the outcome to the 
verifier. 


Definition 6.1. The Pauli basis strategy with parameters n and q (a prime power), denoted 
Pauli(n,q), is the partial strategy with the state |EPR7) and measurement matrices TW for each 


W € {X,Z},u € Fù. 


The main result of this section is the following self-test for the case when q is a power of 2. 


Theorem 6.2. Let W ~ {X,Z} uniformly at random. Let n, q, n satisfy the Pauli basis con- 
dition. Then there is a self-test oasis := Goasis(n,g) for Pauli(n,q) over W with robustness 
d(€) = poly(e,ņn). Moreover, there is a value-1 real commuting EPR strategy with auxiliary state 
|EPR2). Finally, 


Q-length (A asis) =0 (log(n)) ’ A-length(pasis ) = poly(n), 


Q-time(Gpasis) =O (log(n)) ’ A-time(Gpasis ) = poly(n). 


We prove this by a straightforward reduction to the quantum low-degree test of [NV 18a]. 
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6.1 The quantum low-degree test 


The goal of the quantum low-degree test of [NV18a] is to force the provers to use a “compressed” 
version of the Pauli basis strategy. Given W, they should measure their register in the W basis, 
receiving u € Fy. However, u, a length-n string, might be prohibitively expensive to communicate 
to the verifier, so they should instead compute the low degree encoding gu and return its evaluation 
at a single point w € Fẹ of the verifier’s choosing. (The point of this section is to “uncompress” 
their protocol.) 


Definition 6.3. Fix parameters for the low-degree encoding params := (q = p',h,H,m,n,7) 
satisfying the “low-degree conditions” h < q, and n < h™. For any string u € Fj, these parameters 
give a low-degree encoding gu : Fj’ > Fy. 
The low-degree Pauli strategy with parameters params, denoted £D(params), is the partial strat- 
egy with state |EPR{) and measurement matrices 
Ta” = Tiula =E DY Tw 
u:gulw)=a 


for each W € {X,Z},w € Fọ,a € Fy. Equivalently, this is the strategy where we perform the 
Pauli W-basis measurement and output the low-degree encoding of the outcome u evaluated at the 
point w, i.e. the value g,(w). 


The main result of [NV18a] is the following. 


Theorem 6.4 ([NV18a, Theorem 3.2]). Fix low-degree parameters params with p = 2 (so that 
q = 2') and m > 2, and let D be the uniform distribution over (W,w) with W € {X,Z},w € Fy’. 
Then there is a self-test Galowdeg ‘= YQlowdeg(params) for LD(params) over D with robustness 
d(€) = poly (e, md/q°), with c > 0. Moreover, there is a value-1 real commuting EPR strategy with 
auxiliary state |EPR»). Finally, 


Qlength(Yolowdeg) = O(mlogg), A-length(Yaiowdeg) = O(d? log(q)), 


Q-time(GQlowdeg) = O(m log q), A-time(GQlowdeg ) = poly(m, d, log q). 


(We note that this result is stated in [NV18a] for general primes p. However, the p Æ 2 case 
relied on a self-testing result for a generalization of the Magic Square game which was recently 
discovered to contain a bug. Fortunately, the p = 2 case needs only a self-testing result for the 
“traditional” binary Magic Square game, and this follows from [WBMS16].) 


Remark 6.5. We note that the quantum low-degree test, as stated in [NV18a], does not have 
value-1 real commuting EPR strategies. This is because it uses as a subroutine the standard magic 
square game, and the magic square game does not have value-1 real commuting EPR strategies. 
Its value-1 strategies are EPR strategies, and they are real (all observables are either X or Z, with 
the sole exception of the Y &Y observable, which can be rewritten as Y @Y = -(X 8 X). (Z8 Z), 
manifestly real). But they are not commuting, because each row and column have at least one pair 
of noncommuting observables. 

Consider instead the following “oracularized” version of the magic square game: one player is 
given a random row or column (and is expected to play as in the normal magic square game), and 
the other player is given a random cell in that row or column, and the verifier simply checks that 
they agree on that cell. In addition, with some constant probability, both players are given the 
same cell and their answers are checked against each other. In this case, all observables measured 
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With probability 2 each, perform one of the following two tests. 


1. Low-degree: Perform %owdeg (params). 


2. Cross-check: Draw W ~ {X, Z}, w ~ Fy. Flip an unbiased coin b ~ {0,1}. Distribute 
the questions as follows: 


E”, 


o Player b: Give W; receive u € 


o Player b: give (W, w); receive a. 


Accept if gu(w) = a. 


Figure 1: The game %asis(7, q). 


are commuting, and so this variant has a value-1 real commuting EPR strategy. In addition, it 
certifies the same state and measurements as the normal magic square game, and so we can use it 
as a subroutine in the quantum low-degree test instead. 


Remark 6.6. We note again that the soundness case in our definition of a self-test is quite different 
from the one given in [NV18a, Definition 2.5], and it is not clear that a self-test in their sense implies 
a self-test in our sense. However, for the quantum low-degree test, their soundness case does match 
ours. By [NV18a, Lemma 4.1], there is a local isometry ¢ = ¢) ® ¢2 such that 


ll I9) — lẹ) laux} ||? < 4(e). (39) 
and 


ayy Willd OT © Tacs) I) — (72 © Faux) © Tao |) lau) |? <4(2). (40) 


The key difference from our self-test definition is that, as stated, their local isometry need not 
be symmetric (i.e. ¢1 # $2), but their construction actually does give a symmetric isometry with 
$1 = $2. Then, from Equation (40) it is easy to derive Equation (36) using Equation (40) and the 
triangle inequality (Fact 4.28). 


6.2 Proof of Theorem 6.2: the Pauli basis test 


We now state the Pauli basis test. 


Definition 6.7. Let n,q,7 be as in Theorem 6.2. Fix the remaining low-degree parameters params 
as follows: 


h = [0], m=2 | Pet), d=m-(h—1). 


Then the Pauli basis game asis(n,q) is given by Figure 1. 


These parameters are chosen so that they are valid low-degree parameters (guaranteeing the 
existence of the low-degree code), which is necessary for the quantum low-degree test. In particular, 
these satisfy (i) h < q and (ii) n < h™. The first of these is immediate; as for the second, 


n> (gyre) log(q) — glog(n)/log(a) — p, 
In addition, the code has relative distance d/q < mh/q < n. 
sie Ce 


log(n) q1? _ 8log(n) 


a 8: 
q q q log(q) 
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where the final step is because n, q, n satisfy the Pauli basis condition. Finally, we note that even if q 
is a large polynomial of n, m is always at least 2, which permits us to use the quantum low-degree 
test. We now prove Theorem 6.2. 


Proof of Theorem 6.2. The question lengths and times of both the quantum low-degree test and 
the cross-check are given by 


log(n) 
log(q) 


alea | l -log(q) = O(log(n)). 


As for the answer lengths and times, these are bounded by poly(n) for both the quantum low-degree 
test and the cross-check. We now consider the completeness and soundness cases separately. 


Completeness. Let (Y, M) be the value-1 commuting EPR strategy for the quantum low-degree 
test guaranteed by Theorem 6.4. This has state |y) = |EPR{)|EPR2) and measurement matrices 
MW” = TW” ® Isux. If we add in the measurement matrices MW = TW ® aux, then this strategy 
passes the cross-check with probability 1. This is because after Player b measures u, the state 
collapses to |r”) |r”) |EPR2), and so Player b will measure a = gy,(w). As a result, this is a value- 
1 strategy. Furthermore, it is a commuting EPR strategy because the cross-check measurements 
MW and MW” commute. Finally, this strategy extends the Pauli basis strategy. This proves the 
completeness case. 


Soundness. Throughout the soundness, we will use ô(€) to denote a function of the form poly(e, n) 
which may change from use to use. The 6(€) in Theorem 6.4 is of this form because d/q < 7. 

Let S = (Y, M) be a strategy with valg . «ic (S) =1-—e. Then this strategy must pass Glowdeg 
with probability at least 1 — 2e. By Theorem 6.4 this gives us a local isometry 6 = local ® local 
and a state |aux) with the following properties: if we define the new strategy S in which |y) = ¢|w) 
and MẸ = local -M . Plan then 


I l4) — JEPRG) laux) |? < ê(e), Mah” ® Ipob Söte) (Ta ® Taux) ® TBob, (41) 


on state |Y} and distribution D. Because S is just a rotated version of S, it also passes {pasis With 
probability 1— e. As a result, S passes the cross-check in Section 6.2 with probability at least 1— 2e. 
By Fact 4.13, we conclude that 


MW (w)=a] ® Ibob Se Iniice @ MW” %5(c) Ialice 8 COPS Laux) Sie 8 Gj 8 Tux) (42) 
on state |Y}. By Fact 4.14 and the fact that the 7 measurements are projective, this implies that 
My ww) =a) 8 IBob ~5(e) Talice Q (ue 8 Laine) 


Now by Proposition 4.42 (where we let s be the singleton distribution on the “trivial” subspace 
s = Fy’) and the fact that d/q <n, we can conclude that 


Mw ® IBob ~5(e) Inlice 8 GY Q Dowel: 
Applying Fact 4.13 again, this yields 
Mw’ Q IBob ~6(e) I alice & (rY Q Taux) ~6(e) (Y & Fixe) & IBob (43) 


on state |), where the last step uses Fact 4.22 to combine Fact 4.38 with Equation (41). The 
analogous statement for the state |EPR7) follows from Fact 4.22. This establishes the theorem. O 
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Flip an unbiased coin b ~ {0,1}. With probability i each, perform one of the following four tests. 


1. Pauli basis: Draw (x, x’) ~ %asis(nk, qk, N). Distribute the questions as follows: 


o Player b: give (H*—!, æ); receive a = (aj, a2). 


o Player b: give (H*~1, x’); receive a’ = (a4, a4). 
Accept if ag and a4 are accepting answers to the Pauli basis test. 


. Cross-check: Draw (x, 2’) ~ Gemi. Write x = (x1, £2) with a, = (W1,..., Wk). Dis- 
tribute the questions as follows: 


o Player b: give a; receive a = (a1, @2), where a; = (uj,..., Ug). 


o Player b: give (H*—!, W,); receive strings a4 = (uj,..., uh), u! € i 
If W, € {X, Z}, accept if up = ul. Otherwise, accept if up = Ø. 
. Consistency check: Draw (x, £’) ~ Lemi. Distribute the questions as follows: 


o Player b: give a; receive a 


o Player b: give x; receive a’. 
Accept if a =a’. 


. Play game: Perform Gemi. 


Figure 2: The game Cgemi-+(k—1) (Gemi)- 


7 Compiling games with the Pauli basis test 


In this section, we show how to use the Pauli basis test to implement the compiler Csemi=(k—1): Our 
construction is given in the following definition. 


Definition 7.1. Let Kemi be a (k,n, q)-semiregister game. Then its compiled version is the game 
Csemi+(k—1)(Yeemi) defined in Figure 2. 


In words, the provers might try to “trick” the verifier by using one of their (k — 1) existing EPR 
registers to answer queries meant for the new k-th register. To prevent this, the verifier performs 
the Pauli basis test with the first k — 1 registers hidden, forcing the provers to introduce a new 
EPR register. It then cross-checks the provers’ answers in the Pauli basis test with their answers 
in the game femi- The performance of the compiler is given by the following theorem. 


Theorem 7.2. Let A = (k,n,q), and let nk, qk, and n satisfy the Pauli basis condition. Suppose 
Gomi is a A-semiregister game, and consider the r|,_1-register game Y,—1 = Cyemi->(k—1) (Geemi)- 


o Completeness: Suppose there is a value-1 \-semiregister strategy for Gem which is also a 
real commuting EPR strategy. Then there is a value-1 \|,_1-register strategy for G—, which 
is also a real commuting EPR strategy. 


o Soundness: If val), ,(%-1) = 1—e then valS™ (Gomi) > 1 — ô(e), where 5(€) = poly (e,n). 
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Furthermore, 


1) = Q-length (Hemi) + O(log(n)), 
G1) = Q-time(Gemi) + O(log(n)), 

_1) = Alength(Gemi) + poly(n), 
A-time(Y_1) = A-time(Gemi) + poly(n). 


Proof. The communication and time complexities are the result of combining the communication 
and time complexities from Gem; with the values for the Pauli basis test from Theorem 6.2. 


Completeness. Let (Y, M) be a value-1 A-semiregister strategy for Yemj which is also a real 
commuting EPR strategy. Then |) = |r1)---|rx) |aux), where each |r;) = |EPR;') and |aux) is 
an EPR state. In addition, let (7’,M’) be the value-1 real commuting EPR strategy for vasis 
guaranteed by Theorem 6.2. Then |’) = |EPR;*) |aux’), where |aux’) is an EPR state. 

Consider the following strategy for @_ . For its state, it uses |r1):-- |r) Jaux} jaux’). For 
inputs drawn from Kemi, it uses the matrices in M applied to all but the |aux’) register. For inputs 
of the form (H*~!,x), where x is sampled from asis, it outputs Ø! along with the result of 
applying M’ to |r) and |aux’). Finally, for inputs of the form (H*~, H) and (H*~1, L), it outputs 
@*. This forms a valid A\z—1-register strategy for %_1. In addition, its “auxiliary register” is 
|r) |aux) |aux’), which is an EPR state. Now we show that it has value 1. 

By construction, this strategy passes the Pauli basis test and %em; with probability 1. As for the 
cross-check, when Wg € {H, L}, the strategy always succeeds because (wy, M) is a A-semiregister 
strategy. On the other hand, when W% € {X, Z}, this implies that ux is the result of applying the 
rWk measurement to |r;,), putting it in state ie ) [r +). But then because (~’, M’) implements 
the Pauli basis strategy on |r;), the outcome u; is also the result of applying the rWk measurement 
to |r). As a result, uj, = up. 

Finally, it is clear that this forms an EPR strategy. As a result, by Fact 4.37, the consistency 
check passes with probability 1. Thus, the strategy passes the overall test with probability 1. Next, 
we show that this gives a commuting EPR strategy. For the questions that arise in the Pauli basis 
test, the consistency check, and Kemi, commutation follows because M and M’ are commuting. 
As for the cross-check, consider the case when Wg E€ {X, Z}. Then the first (i.e. Player b’s) 
measurement is given by 


©1422 Wi L1,L2Q 
(Marae Miss .k,aux @ Taux = = Ty 8 (Au Up intial 1,...,k—1,aux,aux’> 


where A is some measurement. This follows because M is a \-semiregister strategy. Similarly, the 
second (i.e., Player b’s) measurement is given by 


(TE 8- 9 rA). .„k— 18 (Myr aux’ Taux = Ty ® h,. .,k—1,aux,aux’- 


By inspection, these two commute. On the other hand, when W% € {H, L}, then Player b always 
outputs @*. Their measurement for this outcome is the matrix T 1,...,k,aux,aux’, and is the zero matrix 
for every other outcome. These clearly commute with any strategy for Player b. 

Finally, because M and M” are real strategies, this strategy is also real. As a result, this gives 
a value-1 real commuting EPR strategy. 


Soundness. Suppose Sreg = (Wreg, Mreg) is a A|~—1-register strategy for Y,_1 with value 1 — e. 
By Lemma 5.3, we can assume without loss of generality that M is projective. For 1 <i < k, write 
ri) := |EPR;). By definition, |~reg) = |r1) @ +++ @ |rk-1) Q |avXreg). Our goal will be to decode 
Sreg into a A-semiregister strategy Ssemi for emi with nearly the same value. 
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Using the Pauli basis test. Passing the overall test with probability 1 — € means that Syeg 
must pass the test in Item 1 with probability 1 — 4e. This test only involves measurements of the 
form CM aus. Because the first k — 1 coordinates are hidden, Equation (38) allows us 
to write 

Mag = Ii, k-1 & (AG, Jaux 


where {A7}, is some set of measurements. As a result, the state |auxreg) and measurements {A} }r 
form a strategy for the game %pasis (Nk, qk, N) Which succeeds with probability 1— 4e. By Theorem 6.2 
this gives us a local isometry ¢ = local ® Ploca] and a state |aux) such that 


lI Jauxreg) — |r) laux) ||? < â(€), (44) 


(Piocal ` AW ` Ph cal Alice ® IBob ~6(e) ae ® Lame) Alice ® IBob, (45) 
on state |r) jaux) and the uniform distribution on {X, Z}. 


Define the new strategy S in which |Y) = |r1) S -+ Q |rg_-1) Q (G|auxyeg)) and 


Me = (Er, let & (Plocal Jaux) : (Mies), z lea & Ce? 
Then Equations (44) and (45) implies that 
ll 4) — |r1) 8 ++ rr) laux) ||? < 4(€), (46) 


(Me™) Aice 8 IBob Sse) (Lh,...,h-1 @ TH” ® Laux) Alice ® IBob; (47) 


on state |W) and the uniform distribution on {X, Z}. Because S is just a rotated version of Syeg, it 
also passes Y 1 with probability 1 — e. In addition, it is also a A|,_1-register strategy. 


Performing the cross-check. To analyze the cross-check, we begin with a definition. Given 
W € {X,2Z,H,1} and u € Fj U {Ø}, define nullw (u) = u if W € {X, Z} and Ø otherwise. The 
cross-check in Item 2 checks equality between ug and nullw, (u4). As a result, 


(ME nice @ Tage Se Tni S (M Pah Bob: 


[nullw, (u, )=ug] 


Next, we note that when W; € {H, L}, 


H,...,H,Wk 


pia Wp 
[nullyy, (ut )=u] — Ii,...k-1 8 Ty,” 8 Laux; 


because both sides are the identity when uz, = Ø and zero otherwise. On the other hand, when 
Wk € {X, Z}, these two are close due to Equation (47). Applying Fact 4.24 and Fact 4.28, we get 


(Mz, Alice 8 IBob ~6(e) alice @ (L,...k-1 Q ih ® Iaux) Bob; (48) 


e 


where we have also applied Fact 4.13 to switch to the “~5(,)” notation. 


Extracting a strategy. Now we use this to define a \-semiregister strategy Ssemi for Gemi. This 
strategy will have state |Wsemi) = |r1)---|rg) |aux). In addition, for each input z = (21,22) and 
output a = (a1, a2), it will have a matrix 


Atit2 .— (Th, k-1 Q 7 We Q aux) ’ Mtr ; (Ti, k-1 Q Te 8 Taux). 


41,42 k (u1,...;Up—1),@2 
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First, it follows from M being a A|,_1-strategy that this is indeed a A-semiregister strategy. This 
is because 


ee 2 (Ii,...k-1 Q aie Q Taux) . M2172 : (I, k-1 Q aie Q oe 


U1 y+ Uk—1 
Wk 
k— 


= (h,...jk-1 ® a Q Tae) 4 Ge QD- Q Tu 


W: W, 
= p Q e Q T Q Tama 


a & Ik,aux) $ (Ii,...k-1 & Te &® Iaux) 


In addition, if S = {i Æ k | W; = H}, then 
Aa — (tect ® aie ® Taux) ` (Is & Az) ` (Ii, k-1 ® 7k ® Taux) =Is® AS, 


where A and A’ are matrices acting on the registers not in S and on the auxiliary register. 
Next, we show that this has good value. Write D for the marginal distribution of questions 
given to player 1 in emi. By the consistency check, 


wae „JAlice ® IBob ~s(c) Lalice 9 (Mii. ) a2) Bob 


(ui ,.-.,Uk—1),0 (u1,...,UR—1), 
with respect to D. As a result, Equation (48) and Fact 4.33 imply that 
(Ag )alice 8 IBob ©6(c) TAlice 8 (Ma) Bob 6(c) (Ma) alice ® Jpop, 


where the last step uses the self-consistency of M. Applying Fact 4.32, Ssemi passes Gem with 
probability at least valg,_,(S) — d(€). Thus, val\"(Gemi) > 1 — 6(€), and we are done. oO 


8 The data hiding game 


In this section, we introduce a new, simple game called the data hiding game. This game assumes 
two (k,n,q)-semiregister provers with a shared state |r1)--- |r} |aux). The goal is to test that a 
given measurement { M? }a acts as the identity on the k-th register. 


Definition 8.1. Let x = (x1, £2) with zı = (W1, ..., Wp), and suppose Wg = H. Then the data 
hiding game fide := Griae(Z) is given by Figure 3. It has the following parameters: 


Q-time(4ride), Q-length(Gride) = O(|z]), A-time(Gride); A-length(Giide) = OQ ini log(qi) + £). 
Here @ is the maximum of |ag|, |a4| over all answers az and a‘ given by the provers. 


Draw W ~ {X,Z}. Set xv’ = (x},x2), where x = (Wi,...,Wx-1,W). Flip an unbiased coin 
b ~ {0,1}. Distribute the questions as follows: 


o Player b: give x; receive (a1, a2). 


o Player b: give ax’; receive (a, a4). 


Accept if ag = a4. 


Figure 3: The game %iae(x), with input x = (x, £2) 


For a measurement {M,}, which operates on multiple subsystems, it will be convenient to 
define a version of the measurement in which one of the subsystems is “hidden”. 
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Notation 8.2. Let M be a matrix which operates on H1 8 --- Hk Haux, and let i € [k]. Define 
the notation 


1 
hide; (/) = (i) -Li @ tr;(M). 


If {M.}a is a measurement, then so is {hide,(M,)}q_ (though it may not be projective, even if 
{M,}a is). Our main result regarding the data hiding game is that passing it with high probability 
certifies that {Ma }a is close to {hide,(M,)}. 


Theorem 8.3. Let x be as in Definition 10.8. 


o Completeness: Let Sparti = (Y, M”) be a partial (k,n, q)-register strategy which is also a 
real commuting EPR strategy. Then there is a (k,n, q)-register strategy S extending Spartial 
which is also a real commuting EPR strategy such that valg a (S) = 1. 


o Soundness: Let S = (Y, M) be a projective (k,n, q)-semiregister strategy such that valg (8) > 
1—e. Then 
(Mg alice @ IBob ~e (hidex (M7) )atice ® IBob 


on the singleton distribution on input x. 


This section is organized as follows: in Section 8.1 we introduce the Pauli twirl, and in Section 8.2 
we use it to prove Theorem 8.3. Finally, in Section 9, we design our compiler from layer-two to 
layer-one. This last step is essentially standard and is included for completeness. 


8.1 Some facts about the Pauli twirl 
Definition 8.4. The Pauli twirl Z : B((C42)®") > B((C%)®") is the linear operator 


F(A):= E [X(u)Z(u')-A-Z(-w’)X(—-u)] . 
uu WF? 
Proposition 8.5. Let P be a Pauli matrix on n qudits of dimension q. Then 7(P) = P if P isa 
multiple of the identity, and otherwise J (P) = 0. 


Proof. The case when P is a multiple of the identity follows from the definition. Otherwise, we can 
write P = w*X(a)Z(b), where at least one of a and b is nonzero. Then 


GP = E [X(u)Z(u’) - P- Z(—u')X(—u)] 
=w* E |X(u)Z(u’)- X(a)Z(b)- Z(—w')X(-u)] . 


u,u! 


By the Pauli X and Z commutation relations (Equation (10)), this rearranges to 


w E poe eet . X(a)Z(b) — E (apat .P= E [ea] E [rhb .P=0. 


u,u! u,u’ u 
Here the last step uses Fact 3.1 and the fact that at least one of a or b is nonzero. O 


In the next couple of sections, we will consider the effects of applying the Pauli twirl to our 
measurements. For convenience, we will “group” our state into two parts: |) = |r} is the 
subsystem we want to hide, and |w2) = |r1)---|r,—1) laux) is the remaining part of this state. In 
this way, we can consider our measurements as operating on the bipartite state |y) |W). 
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Proposition 8.6. Let {M,} be a measurement on the state |Y) = |W) |w2). Then 
(FA, ® id2)[Ma] = hide; (Ma), 
where idz is the identity superoperator applied to the second register. 


Proof. Let Py be the elements of the Pauli group on n qudits of dimension q, with Py = I. Because 
these form a basis for the set of matrices, we can write 


Ma = X_ PI ® Mas, 
J 
where the M,,7’s are matrices acting on the auxiliary register. Using Proposition 8.5, 
(Fi ® idg)[Ma] = X 7 (P1) ® Ma, = Po Q Mao =1® May. 
J 


On the other hand, because Py is traceless unless J = 0 (i.e. Py is the identity), 


1 
hide; (Ma) = X` hide: (Py ® Ma,3) = a -IQ tr (Py @ Ma3) = I Q Mao. 
J J 
These two are equal, completing the proof. O 


8.2 Hiding a single coordinate 


In this section, we prove Theorem 8.3. Prior to doing so, we prove a couple of technical lemmas. 
The first shows that a measurement which approximately commutes with the Pauli measurements 
also approximately commutes with the Pauli observables. 


Lemma 8.7. Let W € {X, Z}. Suppose {Ma} is a measurement on the state |Y) = |EPRY) |2) 
for which 
(Ma - (TW @ I2))aiice ® IBob 5 (TAY 2 In) - Ma)atice ® TBob: 


Then the statement 
(Ma - (W (u) 8 I2))alice ® IBob %5 ((W (u) 8 T2) - Ma)atice ® IBob 
holds with respect to the uniform distribution on u € F}. 


Proof. Our goal is to bound 


EDM u) 8 I2) — (W(u) 8 Ia) - Ma) 8 T |) |P. (49) 


by ô. To do so, for a fixed u we introduce the notation 


A? := Ma- (W (u) @ In) — (W (u) 8 In)» Ma 


= ÑO wt (My: (1¥ 8 b) — (TY 8 b) + Ma). (50) 
veFg Aav 


We record the following identity, which follows from Equation (50): 


B(Az)! =E err A Aug) Aan Daw: 


v,v' EF? veFn 
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As a result, 


=EN Az 81) |p) |? = oD (WI (AZ)AT ® T) 


55 (| (Aan) Aao ® Ip) 


a very 


= X [Aav @ I |p) ||? 


a,v 
But this is at most O(ô), by assumption. This completes the proof. O 


The next technical lemma shows that a measurement which approximately commutes with 
products of X and Z observables is approximately equal to its own Pauli twirl. 


Lemma 8.8. Consider the distribution D on pairs (u,u’), where u, u' ~ Fj. Suppose {Ma} is a 
measurement on the state |Y) = |EPR%) |2) for which 


((Z(u’).X (u) ® Iz) - Ma) ® Ibob %5 (Ma: (Z(u')X (u) 8 I2)) ® Ipon: 


on distribution D. Then 
Ma ® Ibob &5 (A Q id2)[Ma] Q IBob. 


Proof. By definition, 


(A @ id2)[Ma] = E [(X(u)Z(w’) 8 Ib) - Ma: (Z(-w!)X(—u) 8 h)]. 


Similarly, 
Me E AN u)Z(u') @ D): (Z(-w') X(—u) 8 I2): Mal. 
As a result, if we set AW = X(u)Z(u’) 8 Ib, and 
BY“ = (Z(-w')X(—u) @ D) - Ma — Ma: (Z(-u')X(-u) 8 D), 


then 
Aa := Ma — (Ji 8 id2)[Ma] = E [A™" - B” |. 


We can therefore establish the lemma as follows: 


DIA a)Alice ® Ipob hh ||? = Dol E [AY - Be] @ Teo) | 


< E >, ||(A%™ . BY) @ Teob |W) ||? (Jensen’s inequality) 
u,u’ 
= BY IBE”) 8 Teo lW) |? (A%“" is unitary) 
u,u! 
By assumption, this quantity is O(ô). This concludes the proof. O 


Now we prove Theorem 8.3. 


Proof of Theorem 8.3. We consider the completeness and soundness cases separately. 
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Completeness. Let Spartial = (Y, M”) be a partial (k,n, q)-register strategy which is also a real 
commuting EPR strategy. To this strategy we will add matrices for the questions 2’ = (x1, x2) 
with Ti = (Wi, fom Wei, W). 
Let a1 = (u1,..., ux), where u; = Ø if W; € {H, L}. Let S = {i | W; Æ L}. By definition of a 
(k, n, q)-register strategy, 
Mian ol, 


ics 
where Mas acts on the auxiliary registers and the registers not in S. Next, set a’ = (a4, a2) where 
i j / n 
a, = (u1,.-. , Uk—1, Up) and u, € FF. Then we set 
TIT W; WwW L,a1 
(Mi = OO a, @ Ty a Ma. 
icS\k 


This is a (k, n, q)-register strategy for fide by design. To see that it is value 1, suppose on question x 
Player b measures a1. Then by Fact 4.38, Player b will measure aj in which u; = u; for all i < k. 
As a result, to measure a2, Player b will measure M*:® and Player b will measure M**!, both on 
state |rg) |aux). As this is an EPR state, by Fact 4.37 the outcomes will always be the same, and 
so this strategy has value 1. The fact that this a real strategy follows from the assumption that 
the matrices MZ are real, and the fact that for W € {X, Z}, rW is a real matrix. Finally, the fact 
that this is a commuting strategy follows from the fact that M? and (M‘)®, are commuting. 


Soundness. We write x and 2’ = (x, £2) with 2) = (W1,...,Wx_1, W) as in the test. Because 
the test passes with probability 1 — e, Fact 4.13 implies that 


(Mz, Alice D IBob ~e IAtice ® (MZ )Bob- 


Because S is a (k,n, q)-semiregister strategy, Equation (37) implies that Mz = en & Iz, where we 
write Ip := J1,...k-1,aux- Our next step is to show that the measurements approximately commute. 
This follows the analysis of the commutation test (cf. [CGJV18, Lemma 28]). 


Mg Mz, ® IBob Se Me @ Mz (Fact 4.20) 
X0 Lalice Q MEMZ (Fact 4.38) 
= Aice © MŽ MZ 
x: Mz, D MZ (Fact 4.20) 
0 Mz MZ ® Ipop- (Fact 4.38) 


In summary, 
(ca ® Tz) à Mz, )Alice Q IBob Xe (Mi G (a & Tz) )alice Q Igob. 
Recall this is with respect to the distribution W where W ~ {X, Z} is uniform. Therefore, it also 
holds with respect to the distribution where W is fixed to either X or Z. As a result, for a fixed 
W € {X,Z}, by Lemma 8.7, 
(Ma, ` (W (u) 8 FR) alice @ IBob ~e (W (u) @ Tg) < Miz alice 8 IBob- 

on distribution u ~ Fj. As a result, by Fact 4.38 and Fact 4.20, 

(MZ, : (Z) X (u) 8 Tp))aice Q IBob %0 (ME, - (Z(u’) 8 Tp) aice 8 (X(—u) 8 EE) Bob 
Re ((Z(u') @ IE) - Mz, )Alice Q (X (—u) 8 FE) Bob 
xo ((Z(u') @ I) - MG, (X (u) 8 FR) ) alice ® IBob 
Re ((Z(u') X (u) @ Ip) - MZ, alice 8 IBob; 
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With probability ; each, perform one of the following three tests. 


1. Data hiding: Draw (2,2’,C) ~ Fk, where x = (a%1,%2) and zı = (Wj,...,W;). If 
Wp, =H, play Gide with question æ. 


2. Play game: Perform %. 


Figure 4: The game Cx_ssemi(%).- 


on distribution u, u’ ~ Fj. Applying Lemma 8.8 and Proposition 8.6, we can therefore conclude 


Mz, © Ibob Se (T Q idp) Mi] ® IBob = (hidex(Mz,)) S TBob- O 


9 Compiling games with the data hiding test 


Now we can show how to compile games from the second layer to the first layer. Our construction 
is given in the following definition. 


Definition 9.1. Let G@ be a (k,n,q)-register game. Then its compiled version is the game 
Cr-ssemi(Y) defined in Figure 4. 


Theorem 9.2. Suppose G, is a (k,n, q)-register game, and consider the (k,n, q)-semiregister game 
ace = Cesena (Gr). 


o Completeness: Suppose there is a value-1 (k,n,q)-register strategy for y which is also a 
real commuting EPR strategy. Then there is a value-1 (k,n, q)-semiregister strategy for Gemi 
which is also a real commuting EPR. strategy. 


o Soundness: If vali (Hemi) > 1— e then valk.nq(G) > 1— d(€), where 5(€) = poly(e). 


Furthermore, 
Q-length(Gemi) = O(Q-length(Y,)), A-length(Gemi) = O(A-length(Y)), 
Q-time(Geemi) = O(Q-time(Y)),  A-time(Gemi) = O(A-time(%)). 


Proof of Theorem 9.2. The communication and time complexities are the result of combining the 
communication and time complexities from 4 with the values for the data hiding game from 
Definition 10.3. 


Completeness. Let (y, M) be a value-1 (k,n, q)-register strategy for % which is also a com- 
muting EPR strategy. Then for every x = (21,22) where x; = (Wj,...,W,) with Wp = H, by 
Theorem 8.3 we can extend this strategy to one that passes the data hiding game with question x 
with probability 1. Thus, this strategy has value 1 overall. In addition, Theorem 8.3 implies this 
strategy is a real commuting EPR strategy as well. 


Soundness. Suppose S = (Y, M) is a (k,n, q)-semiregister strategy for semi with value 1 — e. 


By Lemma 5.3, we can assume without loss of generality that M is projective. Our goal will be to 
decode S into a (k,n, ¢q)-register strategy Sk with nearly the same value. 
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Using the data hiding test. For a fixed question x, write v, for the probability that S passes 
the test in Item 1. Then on average, the probability that S passes this test is E, vz, which is 
at least 1 — 2e because the overall test passes with probability at least 1 — e. This implies that 
Va > 1 — e!/? with probability at least 1 — 2e!/2. Given a matrix M and a W € {X, Z, H, L}, let 
us write hideyw(M) := hide,(M) if W = H and hidew(M) := M otherwise. For a question zx, if 
Wk # H, then hidew, (M2) = Mē trivially. On the other hand, suppose Wk = H. Then either 
Vy > 1 — e"/2, in which case M? ® Ibob Sile) hidew, (Mz) 8 IBob by Theorem 8.3, or vz < 1 — ef, 
in which case we have the trivial bound M? Q Igob %1 hidew, (M7) ® Igob from Fact 4.19. Since 
this latter case happens with probability at most 2e!/2, averaging over all x gives us 


Mz 2 Ibob *4(c) hidew,(Mz) Q IBob, (51) 


on the distribution D. 


Extracting a strategy. Define the strategy Sp = (4%, A), in which AZ := hidew, (Mg). First, we 
show that Sx is a (k,n, q)-register strategy. To do so, fix x = (#1, 22) with zı = (W1, ..., Wp) and 
a = (a1,a2) with a; = (u1,..., uz). Then 


Aaa = hidew, Ge ee a. ® Taux) = no D- 8 aire Saig: 


The first equality is by definition of A and the fact that S is a (k,n, q)-quasiregister strategy. The 
second equality is trivial when W; Æ H and follows from the fact that TM k = I when Wk = H. 
Next, define S = {i Ak | W; = H}. If W, A H then A? = M? = Mz® Is for some matrix M. 
Otherwise, if Wẹ = H, set F = tr(J;,). Then 

1 1 


A? = hide,(M7) = hide, (Mz Q Is) = E Ik 8 tr;,(Mz @Is) = E` Isuk ® tre( Mz). 
The matrix tr,(Mg) - E~! only acts on the registers in SU& and the auxiliary register, and as a 
result, this strategy satisfies data hiding. Thus, Sp is a (k,n, q)-register strategy. 

It remains to show that Sp has good value. This follows by combining Equation (51) with Fact 4.32: 
valy (Sk) > valy,,,.,(S) — d(€), and so valk ng(@) > 1— d(e). oO 


S 


10 Partial data hiding 


The data-hiding game presented above was used to show that the provers’ measurement acts as 
identity on a subset of the provers’ qudits, and thus the prover learns no information from those 
qudits. In particular, the measurement outcome of any X- or Z-observable measurement on the 
qubits in the subset is hidden from the prover. In this subsection, we generalize this idea to show 
how to certify that certain partial information about a register is hidden from a prover. This test 
is a crucial component in our technique of introspection, wherein two provers measure a shared 
EPR state to sample from the joint distribution over questions of a classical game. The partial 
data hiding test will prevent one prover from learning the question sampled by the other prover. 


Notation 10.1. Given a set v = {v1,..., Up} of k vectors in Fj, denote their span by V = 
span({v1,...,v7%}). The orthogonal complement of their span is the subspace Vt = {a : Vi € 
{1,..., k}, (a, vi} = 0}. We denote by Surfaces, the set of all affine subspaces parallel to V, i.e. sets 
of the form: 


s = {u + `u +e H AÀkUk | A1, Ak E Fg}. 
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For a subspace s € Surfaces,,, the subspace projector II? is the projector 


H; = $ lw) (wl. 


wes 
Lemma 10.2. Given a set of vectors {v1,..., Vk}, let 
X = X 
TNiu- vi=a;] = ia Tu 
u:Vi,Uu-Vi=ai 
Then en commutes with II? for all s € Surfaces,,. 


Proof. The proof is by calculation. 


Ms Tiun] = >_lwwl So mae 


wes u:Vi,u-Vi=a; 


ay D Ew eM |w) (w| X(b). 


WES wVi,w-Uj; =a; 


We note an important fact: for any two outcomes u, u’ satisfying u v; = u’ - vi = a; for all i, the 
difference u — u’ must lie in V+. Fixing some appropriate outcome vector ug, we can then express 
the summation variable u as ug + x where x runs over V+: 


=Y YS Be toot fe) (wl X() 


WES gEeVt 


D Ew" b-(uo+2)I Jaw) (w — b]. 


wes reVt 


Now, the summation over x vanishes unless b € (V+)+ = V, by Fact 3.2. This happens with 
probability g*-" which cancels out the factor of q”~* from evaluating the sum over x € V+, 
yielding: 


= wt buo Jay) (ew — b]. 


Now, since b € V, and the summation variable w runs over an affine subspace parallel to V, we 
can shift it from w to w + b, yielding 


= X` E whol fay + b) (w|. 
beV 
Wes 


Finally, we can perform the same manipulations in reverse: 
N v 
= Ti antag ls : 0O 


Definition 10.3. The partial data-hiding game is given by Figure 5. 


Theorem 10.4. Let S be any set of k-tuples of vectors in F}, and let x be an arbitrary query. 
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Given a set S of k-tuples of linearly independent set of vectors v1,..., vg € FG and a query string 
x. Sample v = {v1,..., Vk} uniformly from S. Flip an unbiased coin b ~ {0,1}. Perform one of 
the following three tests with probability 1/3 each. 


1. Distribute the questions as follows: 


o Player b: Give (L,2,v); receive (Ø, a2). 


o Player b: give (Z,a,v); receive (a, ah). 
Accept if ag = ab. 
2. Distribute the questions as follows: 


o Player b: Give (L,x,v); receive (Ø, a2). 


o Player b: give (L, x, {X,v}); receive (Ø, ah, {aii S a pt) 


Accept if ag = aj. 
3. Distribute the questions as follows: 


uD 


o Player b: Give (X,-); receive (a1,-). (Here, is the empty string.) 


o Player b: give (L, L, {X,v}); receive (Ø, Ø, {a} 1>- -- Qi y}). 
Accept if a1; = vi: aq for alli € {1,..., k}. 
4. Distribute the questions as follows: 


o Player b: Give (L, x, {X,v}); receive (Ø, a2, {a1,1, --- , @1,k})- 
o Player b: give (L, L, {X,v}); receive (Ø, Ø, {a1 1,...,a,}). 


Accept if a1; = a}; for all i € {1,..., k}. 


Figure 5: The partial data-hiding game %ide(S, £). 
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o Completeness: Let Spartial = (Y, M>*”) be a partial (1,n, q)-register strategy for fidel S, x), 
which is also a real commuting EPR strategy, and for which 


Ljxjv _ v T,V,S 
Mz = J I; 8 Aa”, 


s€Surfaces, 


for some measurement Aaz”? acting only on the aux register. Then there is a (1,n,q)-register 
strategy S extending Spartia for which valg a(S) = 1. 


o Soundness: Let S = (w, M) be a projective (1, n, q)-register strategy such that valy,.,.(s,x)(S) = 


1—e. Then there exists an ideal measurement Mi+*” with the property that 


Lay OE v S,£,U 
Mg = ) Il, S Mo, 


s€Surfaces, 


such that the measurement Mt’? used by strategy S in response to the query x is close to 
Mi; 
(Mz'*”)atice ® Ipob Se (Mi"*”) alice D IBob- 


To prove this theorem, we will start with some basic facts about the subspace projector mea- 
surements. Let us denote the linear subspace spanned by the vectors v1,..., Ug by V. 


Definition 10.5. For any distribution U over unitary matrices, the twirl by U is the linear operator 
Fy : B((C2)®") + B((C2)®") defined by 


ml) = E, [vavt] . 


Definition 10.6. Let v = {v1,..., vg} be a set of linearly independent vectors over F4. Further let 
V be the uniform distribution over the set {X (a) :a € V}, Z be the uniform distribution over the 
set of all Pauli Z operators {Z (a) : a € Fj}, and S be the distribution over products MN where 
M is drawn from Y and N from Z. Then the v-subspace twirl is the twirl over S: 


Ig = P o Fz 


Proposition 10.7. Let A be a Hermitian matrix and v a set of k vectors over Fy. Then the 
v-subspace twirl of A is a linear combination of projectors onto affine subspaces along v: 


(Zs Q idaux)(A) = `> IT. & (Ms)auxs 


s€ESurfaces, 
for some choice of Hermitian matrices M, indexed by subspaces s. 


Proof. Start by decomposing A into a linear combination of Pauli matrices: 


A=Ņ_ X(u)Z(u') 8 (Auu )aux- 


After the twirl over Z, the only terms that survive are those with no X part, i.e. 


A' = (Iz ® idaux)(A) = `> Z(u) & (Ao,u Jaux 
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Now if we perform the twirl over V, we get 


(Fy 8 idanx)(A!) = X EX (a)Z(u)X(a)* ® (Aowu)aux 


E tr[(a,u)] 
d at” Z(u) & (Ao,u)aux 


= X` Zu) 8 (Aou)aux (Fact 3.2) 
uEeVt 


= SP Swirl pw) (w| 8 (Aoju)aux 


uEeVr w 


» |w) (w| 8 > wiwu] (Ag ax) aux (52) 


ueVvt 


Now, consider a surface s € Surfaces,. For some x € F?, s is the set of points written w = z + v, 


qd 7 
where v € V. Then for any u € Vt, (w,u) = (x +v, u) = (x,u), a quantity which depends only on 
the subspace and not on the point w. Call this quantity csu. As a result, 


(52) = `> >. |w) (w| & > Coal Abie aig = `> IT? & (Âs)aux 


s€Surfaces, WES ueVt s€Surfaces, 
where As = Juey 1 Csu Abas O 


Lemma 10.8. Let W € {X, Z}, and let v = {v1,..., vz} be a set of k linearly independent vectors 
in FG and V be their span. Suppose {Maz} is a measurement for which 


(May : Caer ® Taux)) © IBob %3 (Co ® Taux) + Maz) ® IBob, (53) 
where 
W W 
TMi,v;-a1=a1 4] = > Ta’ 
a1:Vi,vi'a1=41 i 
Then 


(Maz ` (W (u) & die) ® IBob 6 ((W (u) & Taux) : Maz) ® IBob; 


for a uniformly random u drawn from V. 


Proof. To start, given a set of outcomes a11,...,@1,4, Suppose u and u’ are outcomes for a full 
W-basis measurement consistent with these outcomes, i.e. u and u’ are vectors such that for all i, 
u- vi = aii. Then it must hold that u — wu! € yo: Using this, the bound in Equation (53) becomes 


D vm D | 25 (May ` (Taw Q Laux) — (Tew Q Laux) © Maz)  IBob |) i <ô, (54) 
a2 uo weVvt 


where the factor of 1/|V+| is because each outcome aj,1,--- ,@1,4 corresponds to |V+| different 
choices of u. 
Our goal is to bound 


iD, \|(Maz : (W (u) 8 Taux) — (W (u) 8 Taux) © Maz) ® IBob |) |. (55) 
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by 6. To do so, for a fixed u we introduce the notation 


Aaz = Mas (W (u) 8 Laux) — (W (u) 8 Taux) © Maz (56) 
= > ge (May i ay @ Lin) = (rW Q Laux): Mas). (57) 
No 
zeFg Aaga 


We record the following identity, which follows from Equation (57) and Fact 3.2: 


E (An) AR = E, JO MEN Ana) Aare = J D (Aaa) Aostu: 


Yi GH rely rey wevt 


As a result, 


=E) (A4, ® Zeon) |v) ||? = 22 (Y| (AL TAY, 8 Teob |Y) 
a2 


SS So Bea) Aata O to |) 


a2 xEFg weVt 

1 2 

eal 5. Aaz +w © TBob |Y) | ; 
a,x wEV 


where the factor of 1/|V+| is again to deal with overcounting. But this is at most O(6), by Equation (54). 
This completes the proof. O 


Lemma 10.9. Let {Ma} be a measurement and U be a distribution over unitaries, and suppose 
that for U drawn uniformly from U, 


((UŻ ® Taux) © Ma) ® Ipob %5 (Ma + (UT ® Taux)) ® IBob; 
where the distribution inherent in the %5 notation is the uniform distribution over U. Then 
Ma ® IBob S6 (Tu ® Laux)[Ma] ® TBob- 
Proof. By definition, 
(F% 8 Taux)[Ma] = EF [(U 8 faux)» Ma + (UT ® Faux)]. 
Similarly, 
Ma = EU 8 Laux) (UT ® Taux) * Mal. 


As a result, if we set 
B(U)q = (U1 @ Iaux) © Ma — Ma: (UT ® Laux), 
then 
Aa i= Ma — (F @ ux) [Ma] = „EU - B(U)a]. 


We can therefore establish the lemma as follows: 


2 lAa © Taos lY) I? = Dale U)a] ® Teo |) ||? 
< HS |(U » B(U)a) 8 IBob |) ||? (Jensen’s inequality) 
= E >, |B(W)q ® IBob I) ||? (U is unitary) 
By assumption, this quantity is O(6). This concludes the proof. O 


Proof of Theorem 10.4. We consider the completeness and soundness cases separately. 
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Completeness Let Spartial = (Y, M+”) be a partial (k,n, q)-register strategy for Griae(S, £) 
which is also a real commuting EPR strategy, and for which the measurement Mi?” has the form 


tzu v S,L,U 
wes > moar 
s€Surfaces, 
To this strategy we will add matrices for the remaining questions. 
o Question (Z,x): the measurement is 
Zæ) — v Z S,£,V 
Mos y mPa eA, 
s€Surfaces, 


This is a well-defined measurement as II? is diagonal in the Z basis and thus commutes with 


re 
o Question (L, x, {X,v1,...,Uk}): the measurement is 
sa ee = 2, ITs - a TE 8 Aaa 
s€Surfaces, 
This is a well-defined measurement as I? commutes with a T by Lemma 10.2. 
o Question (L, L,{X,v1,...,Vg}): the measurement is 
MALH xX Ql. 


{a1,1; 501, kD = TiVi,a1-vi=a1 i] 


o Question (X, 1): the measurement is 


ME) = 7Ë 8 Tass 
This is a (1,n,q)-register strategy for fide by design, and it is not hard to see that it achieves 
value 1 on the game. Assuming that the partial strategy Spartial is a real commuting EPR strategy, 
it is not hard to see that the full strategy above is also real (this is because if M+” is real and of 
the given form, then the matrices A43” must also be real). That the strategy is also commuting 
follows from the description of fide. In particular, note that while MZ ™° does not commute with 
M+} or with M*-+, the test never requires these measurements to be measured at the same 
time. 


Soundness Recall that a strategy S for this game consists of a state |y) = |EPR7) 8 |aux) 


and measurement operators of three types, corresponding to the four types of queries: M ne) 


Da2 ’ 
(Z,2,v) 1,x,{X,v}, (X,-) 
Maaz 5 {al isn ey and Ma, : 


We start by analyzing the third and fourth parts of the test. The goal of these parts of the 
test is to certify that when given the query ({X, v}, x), the prover returns k answers aj j,... aik 
that are consistent with measuring the X (v1), ..., X (vz) observables on the state. We certify this 
in two stages. In part three of the test, we ask the first prover to do a complete measurement 
in the X basis, and send the second prover the query {X,v} indicating that it is to perform a 
partial X measurement, and check consistency of outcomes. Importantly, in this part of the test, 
we cannot send the second prover the query x, since the corresponding II? measurement does not 
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commute with the complete X measurement performed by the first prover. Thus, in part four of 
the test, we send one prover the query {X,v} and the other (x, {X,v}), and check consistency of 
their outcomes. 

Since S is a (k,n, q)-register strategy, Equation (37) implies that Ma (X, I= X & Ipob- We thus 
have from the third part of the test that 


1,1,{X,v} ~ xX 
{a}, ,..0, p} © TBob ~e Tivi,u-v;=a', | © {Bob 


From the above equation and the fourth part of the test, we have 


MiX} 


1 / 
{44 pO k 


1 @ IBob © Mii {Xe} 


{4 yyy, kl 8 TBob © ~e Ti, uvi =a} al 8 TBob- 


Next, we look at the first and second parts of Mige(S,x). These are essentially two instances 
VA 


of the commutation test. The first part of Gide certifies that the second outcome of Mår az is 
consistent with Ms ee and the hypothesis that the ey S is a (1,n,q)-register strategy tells 


us that the first outcome of MÉ tiz is consistent with 7, 73 Igob. Thus, applying the analysis of the 


commutation, it follows that 
(Mg ®” - (7Z ® Laux) ® Ieo Me (TZ ® Ieo) Mg”) ® Ibob 
A similar analysis for the second part of fidel S) certifies that 
((Ti¥i,ar-vi=a, © aux): Me) Q IBob ~e A PA i aei ® Taux)) Q IBob- 
As a result, it holds that W € {X, Z}, by Lemma 10.8, 
(MEZ - (W (u) ® Toux)) Q IBob Se ((W (u) 8 Laux) : MEZ”) @ IBob. 


where if W = X, then u is chosen uniformly over V, and if W = Z, then u is drawn uniformly 
from Fj. As a result, by Fact 4.38 and Fact 4.20, 


(Majaa > (Z(u')X (u) ® Iaux)) 8 IBob =o (M, 
~e ((Z 
=o ((Z 
~e ((Z 


on the distribution where v is chosen from S, and then u ~ V, wu! ~ Fj. Applying Lemma 10.9 
and Proposition 10.7, we can therefore conclude that 


a (2 (u’) ® Iaux)) ® (X(—u) 8 Laux) 
Taux) + Mg”) ® (X(—u) 8 Laux) 
Taux) Maie - (X(u) ® Taux)) ® Ie 
X(u) ® Taux) MAE NO Tob, 


& 
& 


Maa ® Ieo Se (Zs ® Laux)[MB,a,]® Teo ={ >> TS @ (AB )aux | ® eo 


s€Surfaces, 


L,V,8 


for some choice of measurements Ag” on the aux register. O 
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Part IV 
NEEXP protocol 


11 A review of a classical PCP theorem 
We begin Part IV by reviewing the following classical PCP theorem: 
Succinct-3Sat € PCP[n, poly(n)]. (58) 


This implies, by standard reduction, that Succinct-3Sat € MIP, which is the main result of [BFL91]. 
Reviewing this serves two purposes: (i) our MIP* protocols are inspired by this PCP construction, 
and (ii) their correctness is actually shown by reduction to the correctness of this PCP construction 
(Lemma 15.6 below). This section closely follows the excellent course notes of Harsha [Har10]. 


11.1 The instance 


The input to the verifier is an instance of the Succinct-3Sat problem, i.e. a circuit C of size s with 
3n+3 inputs. We apply the Tseitin transformation to it to produce a formula F with n’ = 3n+3+s 
inputs. It encodes the 3Sat formula Y := Yr on N = 2” variables which contains (x V a V z?) 
as a clause if and only if F (i, j, k, b1, be, b3, w) = 1 for some w € {0,1}5. 


11.2 Encoding assignments 


Writing S = {0,1}”, an assignment to the variables of 7 is a string a € {0,1}5, or equivalently a 
string in {0,1}. The first step of the PCP theorem is to take the low-degree encoding of a. We 
begin by choosing parameters. 


Definition 11.1. Recall that N = 2”, h = 2%, q = 2", and m are admissible parameters if tı < te 
and h” > N. We call them exactly admissible if the stronger condition h™ = N = 2” holds. 


We select n, h = 24, q = 2", and m to satisfy our “rule of thumb” parameter settings 
(Equation (1)): 

n ^10 
h= O(n), m=0(—). @=O((n)”): 
Note that q depends on n’ rather than just n. 

It remains to choose H and m. Our construction requires that the permutation 7 be efficiently 
computable, and so we pick these according to the canonical low-degree encoding (Definition 3.8). 
This entails setting H = H;, 4. As for 7, we modify the construction slightly. This is because the 
canonical low-degree encoding is designed for strings whose coordinates are indexed by an integer 
i € [n], which must first be converted to binary when computing m. However, the coordinates of 
our strings a € {0,1} are indexed by elements of S = {0,1}”", which are already written in binary, 
allowing us to skip the conversion. Hence, within this section, we define 7 := Tn,ti,to : S > H™ by 
setting 


Tissot bn) := Op keto (b1, ---,bn) = (o(bi,... ba) Wee lg aa chy bt), st Opec 41; ,bn)), 


where o := Oh tz- Given these parameters, an assignment a is encoded as a degree-O(mh) polyno- 
mial ga : Fý > Fy. 
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The crucial property of 7 that we will need later is that it has an efficiently-computable, low- 
degree inverse. We will show this here. To do so, we begin by recalling the notation indy,,(y) for 
the indicator function of x € H over H: 


=0 
ind y2(y) = ah 


where b ranges over H. This is a degree-h polynomial which can be computed in time poly(h, q). 


Definition 11.2. Let N = 2”, h = 24, q = 2", and m be exactly admissible parameters. Set 
H = Hitz, © = Ot, ,t2, and T = Ty, t,,t2. Consider the function u := pe tg : Fg > Fi whose i-th 
component is defined as 


wi(y)= Š. indy,»(y). 


xEH:tr|e;x]=1 
Let y = bı - e1 +--+ + 04, - en be an element of H. Then wily) = bi, and so u(y) = (bi,..., bt). 
This means that ju(o(b1,..., b4 )) = (b1,..., b4). As a result, if we define the function v := Vn,ti 5 : 
Fy —> Sn to be 
V(T1, Em) = (U(E1), +++, U(Em)) 

then v(m(x)) = x for any £x € Sn. Each component of v is the sum of A indicator functions, 
and is therefore degree-h and computable in time poly(h,q). As a result, v is computable in time 
poly(n, h, q). 


11.3 Encoding the formula 


Our next step is to produce a similar “low-degree encoding” for the formula ~. This will be 
a function gy : Fm — Fy, for m’ = 3m + 3 + s, with the property that for all i,j,k € S, 
bi, ba, bs € {0,1}, and w € {0,1}*, 


gu (a(t), nlj), a(k), bi, be, b3, w) = F(i,j, k, bi, bo, bz, w). 


This can be accomplished by setting S’ := {0, 1}", viewing F as computing a string ay € {0, ns, 
and setting gy to be its low-degree encoding. However, the verifier in our protocol will be required 
to evaluate gy on a particular input, and this seems challenging given that this gy is computed by 
interpolating over an exponential number of points. Instead, we will produce a gy which we can 
efficiently evaluate at any point using the fact that we have a succinct formula F representing w. 

To begin, we convert F into an algebraic formula which operates over Fy-valued inputs using 
arithmetization (cf. Definition 3.28). Set Farith := arith (F). This is a function Farith : Fr’ >F, 
with the property that for any x € {0,1}”, Faritn(£) = F(x). Furthermore, Faritn has degree O(n’) 
and is computable in time poly(n’,q). We can now define the function gy as follows. 


Definition 11.3. Let N = 2", h = 2%, q = 2", and m be exactly admissible parameters. Set 
V := Vn 4yt9- Let C be a Succinct-3Sat instance whose Tseitin transformation F has n’ = 3n+3+s 
inputs and encodes the formula Y := YF, and let Farith = arith (F). Write m = 3m+3+s. Then 
we define gy := Gu,njtr,to © Rr’ — F, to be the function 


Jy (21, 22,23, by, bo, bs, w) = Facey (Bi) v(x2), v (x3), bı, ba, bs, w). 
This is degree h - O(n’) and can be computed in time poly(n’, h, q). 


For shorthand, we will often write inputs to gy as tuples (xz,b,w) € EOTS where x = 
(x1, £2, £3) contains three strings in Fj” and b = (b1, b2, b3) contains three numbers in F4. 
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11.4 Zero on subcube 


Given a function g : Fj’ — Fy, we would like to check that it is the low-degree encoding of an 
assignment which satisfies y. To do so, we define the following function. 


Definition 11.4. Let N = 2”, h = 2%, q = 2%, and m be exactly admissible parameters. Let C be 
a Succinct-3Sat instance whose Tseitin transformation F has n’ = 3n+3-+s inputs and encodes the 
formula Y := we, and let gy := Gyn,ty,t2. Set M = 3m+3+s. Then given a function g : Fy > Fa, 


we define saty g := Saty g nti ta € F — F, to be the function 


saty g(x, b, w) := In (x, b, w) ` (g(z1) b1)(g(x2) = be)(g(x3) = b3). 


The crucial property we would like to check is that saty g is zero on the subcube Hzero := 
H8™ Q {0, Ler, 


Proposition 11.5. The function saty g is zero on the subcube Hyero for some g : Fy — F, if and 
only if p is satisfiable. If it is satisfiable, g may be taken to be degree-O(mh), in which case saty g 
is degree-O(mh + hn’). 


Note what Proposition 11.5 does not say. It does not say that if saty is zero on the subcube, 
then g is the low degree encoding of a satisfying assignment of Y. It does not even say that g 
must be low-degree. (Indeed, g might have high degree, as saty g only checks g on those numbers 
in the range of m.) What it does say is that if 7 is satisfiable, then there exists such a g which 
is low-degree: the low-degree encoding of a satisfying assignment. Our strategy, then, will be to 
verify that that g is low-degree and then use this fact to verify that saty g is zero on the subcube. 
(We can then “forget” that g is low-degree, as it is no longer required for the analysis.) 

To verify this that saty g is zero on Hyero, we would like it to be encoded so that this is self- 
evidently true. This entails expanding saty in a “basis” of simple polynomials which are zero on 
the subcube. To begin, given a subset S C Fy, define 


zerog(xz) := [[¢ — b). 
beS 
The following proposition shows how to expand into this “zero” basis. 


Proposition 11.6. Let f : Fj — Fy be a degree-d polynomial which is zero on the subcube H = 
H,®---@H,. Then there exist degree-(d — h) “coefficient polynomials” c1,...,Cn such that 

n 

f(x) = zero, .(z) = X zeroy (zi) -clx). 
i=1 
For simplicity, we will write zeroy,. instead of zeroy,.,,.c. We would like our proof to consist 

of the function g and the coefficient polynomials c1,...,Cm/ so that we may check the equality 
Saty g = zeroy,.. The following lemma shows so long as these functions are low-degree, we can 
verify that they are equal, and therefore show that w is satisfiable. 


Lemma 11.7. Let N = 2", h = 2%, q = 2, and m be exactly admissible parameters. Let C be 
a Succinct-3Sat instance whose Tseitin transformation F has n! = 3n + 3 + s inputs and encodes 
the formula Y := wr,. Set m = 3m +3 +s. Letg: Fy > Fy, and set saty g := saty.gnti,to- Let 
Cicer? gr —> Fa, set Hzero = H?™ & {0,1}8+%, and write zeroy, := ZETOHoro,c- Suppose that 
g is degree-d,, and suppose that c,,...,Cm: are degree-dz. Suppose 
max{O(hn’) + 3d1,h + d 
Pr [saty (a) = zerog,(Œ)] > DOU EL 

avr q 

Then w is satisfiable. 
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Proof. By Definition 11.3, saty, has degree h- O(n’) + 3d. In addition, zeroy,, has degree h + d2. 
Define f = saty g — zeroy,-. Then f has degree max{O(hn’) + 3d,,h + d2}. By assumption, 
f(x) = 0 with probability larger than deg(f)/q over a uniformly random a ~ ne By Schwartz- 
Zippel (Lemma 3.6), this means that f = 0, which implies that saty g = zeroy,. But zerop,o is 
self-evidently zero on the subcube Hero, meaning that saty g is as well. By Proposition 11.5, w is 
satisfiable. O 


Ensuring that saty g is low-degree requires ensuring that g is low-degree, and this can be ac- 
complished with the low-degree test. Arguing similarly for zeroy,. requires ensuring that each c; 
is low-degree, and this can be done with the simultaneous plane-versus-point low-degree test 
(Theorem 3.19). 


11.5 The PCP 


We can now state the contents of our probabilistically checkable proof for the satisfiability of w. It 
consists of the following four tables. 


. A claimed low-degree polynomial g : Fj’ > Fy. 
. A set of claimed low-degree polynomials c1,..., Cm’ : Fr > F}. 


1 
2 
3. A “planes table”, containing for each plane s in Fj’ a degree-d bivariate polynomial. 
4 


. Another planes table, containing for each plane s in Fr an m/-tuple of degree-d bivariate 
polynomials. 


The verifier works as follows: first, it performs the low-degree test between g and its planes table. 
Second, it performs the simultaneous low-degree test between the c;’s and their plane table. Both 
of these use the degree parameter d = O((n’)”), which is chosen to upper-bound both O(mh) 
and O(mh + hn’). Finally, it picks a uniformly random (a,b, w) € Rm and checks the equality 
saty,g(x,b,w) = zeroy,-(x, b, w). It accepts if all the tests accept individually. 

When w is satisfiable, there is always a proof that makes the verifier accept with probabil- 
ity 1. This entails setting g to be the low-degree encoding of a satisfying assignment, and setting 
C1,+++;Cm’ to be the coefficient polynomials of saty g. The following proposition shows that when Y 
is not satisfiable, the verifier always rejects with probability at least 5- 


Proposition 11.8. If the verifier accepts with probability at least 9/10, then w is satisfiable. 


Proof. If the verifier accepts with probability at least 9/10, then each individual test accepts with 
probability at least 9/10. Applying Theorems 3.12 and 3.19, we get degree-d functions g : F; >F, 


and ¢j,...,Gm’: ine — F, such that 


dist(g,g) < sar dist(c, €) < 4. dist(saty,g,Zeroy,c) < D- 


(Here, we are assuming that q is a sufficiently large function of m and h.) By the union bound, 
dist(saty g, Saty g) < 3dist(g, 7). As a result, by the triangle inequality 


dist(saty g, zeroyz) < dist(saty g, Saty g) + dist (saty g, ZETO Hc) + dist(Zero He + Zerop g) 
< 3dist(g, 9) + dist (saty g, zeroy,-) + dist(c,¢) < 3- a + 4 + b = 3. 


By Lemma 11.7, ¢ is therefore satisfiable. O 
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Time and communication complexity. 


o Question length: The verifier performs two low-degree tests and draws a random point in 
pa, These are of size O(m log(q)), O(m’ log(q)), and O(m’ log(q)), respectively, all of which 
are O(n’) bits. 

o Answer length: The verifier performs one normal low-degree test, and then a second low- 
degree test with answer complexity m’ times the normal answer complexity. These are of 
total length (m + 1) - d? log(q) = O((n’)°). Finally, in the last test, it queries each of g and 
C1,---,Cm for a point in F}, a total communication cost of (m’ + 1) log(q) = O(n’). In total, 
the answer length is poly(n’). 


o Runtime: The verifier runs in time poly(n’). This includes computing saty g(a, b, w), which 
requires computing g,(x,b, w), taking time poly(n’, h, q) = poly(n’). 


12 NEEXP preliminaries 


12.1 Introspection games 


In this section, we introduce introspection games. These are games in which, rather than the verifier 
sampling the questions, the provers sample them instead. 


Definition 12.1 (Introspection games). An introspection game is played between two provers Alice 
and Bob in which Alice returns two strings 74 and a and Bob returns two strings rg and a’ (the 
verifier does not specify a question). Here, x4 and zp are interpreted as Alice and Bob’s “share” of 
the jointly sampled “question” x = (x4, £p), and a and a’ are interpreted as their “answers”. The 
verifier then applies its evaluation function V to the answers and accepts if V(x4,ap,a,b) = 1. 


The following three facts show that we can convert between strategies for a “normal” game and 
strategies for an introspective version of the game. This allows us to prove soundness results for 
the “normal” game and “bootstrap” them up to the introspective game as well. 


Fact 12.2. This fact concerns two games and two strategies. 


1. Let Gntro be the introspective game with evaluation function V. Consider a strategy Sintro 
for Alice and Bob with shared state |intro) = |question) ® |answer) in which Alice and Bob’s 
measurements are given by 


{Pa4 8 At leaa; {Qz & BP te gis 


respectively. Write D for the distribution on outcomes (x4, xp) when the measurement {Px ,® 
Qrztras.ep is performed on |question). 


2. Let Y be the “normal” game played as follows: sample x = (x4,a%B) ~ D. Distribute the 
questions as follows: 


o Alice: give xa; receive a. 


o Bob: give ap; receive b. 


Accept if V(a%4,a%p,a,b) = 1. Write S for the strategy with shared state |janswer) in which 
Alice’s strategy is {A%4}q and Bob’s strategy is {BZP }a'. 


Then valg(S) = valy,,,...(Sintro)- 
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Fact 12.3. Let {A™}, and {B7}, be measurements such that 
Aa ® Ipob %5 Ba ® IBob (59) 


on state |answer) and distribution D. Nest, let {Qz} be a measurement and |question) be a bipartite 
state such that the distribution of measurement outcomes produced by measuring {Qz Q Ipob}x on 
|question) is D. Then 


(Qr Q AG )atice Q IBob %5 (Qr ® BZ)atice ® IBob (60) 


on state |question) & |answer). Moreover, if Qx is a projective measurement, then the reverse 
implication holds: if Equation (62) holds on |question) ® |answer), then Equation (61) holds on the 
state |answer). 


Proof. First, we show the forward implication. By definition, we want to bound 


y (Qz 2 A® ® Ibob — Qr © BY ® IBop) |question) ® |answer) ||? 


x,a 

= > (Qr ® L)question Q (AG Q I — BZ 2 I)answer |question) ® |answer) I? 
x,a 

= > (question| & (answer| (Qz ® ‘ae Q (AZ @ I — B? @ 1)? ewer [Question) ® |answer) 
x,a 


< - (question| ® (answer| (Qz Q I)question ® (AF @ I — BY @ I)Žaswer question) & |answer) 


x,a 


=E J (answer| (A? @ I — B® @ I)? |answer) 
xz 
a 


=E)_||(A? @ I — B® @ 1)? |answer) ||’. 
xz 
a 
But this is at most 6 by assumption. Now, for the reverse implication, note that if Q, is projective, 
then the inequality above becomes an equality. O 
Fact 12.4. Let {A™}, and {B7}, be measurements such that 
(Aq )alice 8 IBob %5 Talice ® (Bz) Bob (61) 


on state |answer) and distribution D. Nect, let {Qxz}x be a measurement and |question) be a bipartite 
state such that 


(Qz)atice ® IBob %5 IAatice ® (Qz) Bob 


on |question). Furthermore, suppose that the distribution of measurement outcomes produced by 
measuring {(Qz)Alice 8 IBob}x2 on |question) is D. Then 


(Qr ® AG )atice ® IBob %5 Iatice D (Qr ® BG) Bob (62) 


on state |question) ® |answer). 
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12.2 Subroutines and superregisters 


In the next few sections, we will design a set of protocols to be used as a subroutine for our main 
NEEXP protocol. In doing so, we will encounter the following notational difficulty: a subroutine Y 
might be a A = (k,n,q)-register game, whereas the overall protocol which calls it might be a 
u = (l,m, q)-register game. When A is not equal to u, how can we use Y? We will consider two 
answers to this question. In both of them, we will consider the case when all the register field sizes 


ee y 


are the same value “q”, as this is the case relevant to our application. 


Notation 12.5. First, the registers in À might appear as a subset of the registers in u. In this case, 


we will specify an injection x : [k] — [/] such that nj = mę). Given a string W = (W1, ... , Wk), 
we write x(W) for the length-¢ string with W,,(;) in coordinate 7, for each 7, and the “hide” symbol 
H in the remaining coordinates. Similarly, given string a = (a1,...,a¢), we write « +(a) for the 


length-k string with a,,;) in its i-th coordinate. Then playing Y on registers K(1),...,«(k) means 
to do the following. 


1. Draw (x, x’) from Y. 
2. Send (K(a1), £2) to Alice and (K(x), 25) to Bob. 
3. Receive a,a’. Accept if Y accepts on the answers (K~! (a1), a2) and (K~+(a‘), ab). 


Notation 12.6. Second, the registers in A might appear as the concatenation of register in u. In 
this case, we will specify concatenation lengths c(1) +---+¢(k) = £ such that ny = mi +++ + me), 
n2 = M1)41 +++ + Me1)+e(2)- Pictorially, the first register in A will be created as the following 
concatenation: 


|EPR,;") & |EPR;”) Q-Q [EPR 7) 2 [EPR ®) , 
MMMM 


BAe ed) 


|EPR, ) 


We refer to these concatenations of registers as superregisters. A Pauli basis query W € {X, Z, H, L} 
to a given superregister R can be simulated as follows: 


1. Implement each Pauli basis query W by sending W to each register r;,,...,7;, in the super- 
register. 


2. If W € {X, Z}, the prover measures ae on each register r; in R, and the verifier receives the 


outcomes ui, € Fy"',...,u;, € Fy”, concatenated as u = (uj,,..., Wi). 
3. If W = H, the prover performs I ®...® I on the registers in the superregister, and verifier 
——S— 


G 
receives c consecutive @’s, interpreted as a single Ø. 


4. If W = L, the prover may perform any measurement it likes on the registers in the superreg- 
ister. The verifier receives c consecutive @’s, interpreted as a single Ø. 


The game Y will usually be proven sound against A-register strategies, but in our cases it will 
be straightforward to extend this soundness to p-register strategies in the case when Y is applied 
as a subroutine as detailed above. For example, suppose we know that a strategy A which passes Y 
with probability 1 — e must satisfy (Aa) alice @ IBob %8 (Ba)alice ® IBob- Then it is straightforward to 
derive that if Y is played as a subroutine on the second register of u (this is the case when k = 1 
and nı = m2), and if A passes the subroutine with probability 1 — €, then 


(Aa)alice ® IBob %5 (1 ® (Ba)2 ® I3,...,2) alice: ® IBob 


79 


Likewise, suppose Y is played as a subroutine on one superregister consisting of all the registers 
of u (this is the case when k = 1 and nı = mı +--:+ me). If A passes the subroutine with 
probability 1 — e, then 

(Aa)alice ® IBob %5 ((Ba)1,...,e)Alice ® IBob- 


For our applications, it will be straightforward to extend the soundness of our games to the case 
when they are played as subroutines, and we will leave this step implicit in our proofs. 


13 The introspective low-degree test 


In this section, we give the introspective low-degree test. This is an introspection game which 
simulates the classic surface-versus-point test, but is able to reduce the question complexity by 
making the provers sample the questions themselves. We allow for a fully general k-dimensional 
surface, though in our application we will only use k = 1 (lines) and k = 2 (planes). 
Given an integer n > 0 and a power of two q, the introspective low-degree test is a (k + 1,n, ¢q)- 
register game. In other words, the provers share a state of the following form: 
|b) = [EPR o ® IEPRa), O8 [EPRg)k @ |aux) 


aux ' 


The intended behavior is this: the “points” prover should measure the point u € FẸ from register 0. 
The “surface” prover should measure directions v = {v1,...,vx%} from registers 1 through k and 
then should receive their surface s from the surface measurement {II?} surfaces, On register 0. 
If the provers act honestly, then u will be a uniformly random point in s, generating the same 
distribution as the questions in the surface-versus-point low-degree test. 

The key difficulty is preventing the surface prover from fully measuring the register 0 and thus 
learning the value of the point u. In this section, we design a test to enforce this behavior on 
the surface prover, using an introspected version of the partial data-hiding game developed in 
Section 10. This game lets us command the surface prover to erase all information about u except 
its value modulo linear combinations of the directions v1,..., Ug; we give it in Section 13.1 below. 
We use this test in Section 13.4 to design the introspective low-degree test and prove its soundness. 


13.1 Introspected partial data-hiding 


In this section, we give an introspected version of the partial data-hiding game, which will be used 
to implement the surface and intercept-scrambling measurements described above. 


Definition 13.1. Let k,n > 0 be integers, let q be a power of 2, and let A = (k + 1,n,q) 
be register parameters. Let x be an arbitrary query. Then the introspected partial data-hiding 
game MptroHide(A, £) is given in Figure 6. 


The performance of the introspected partial data-hiding game is given in the following theorem. 


Theorem 13.2. Let k,n > 0 be integers, let q be a power of 2, and let A = (k+1,n,q) be register 
parameters. Let x be an arbitrary query. Then Gptroniae := YintroHide(A, £) satisfies the following 
two properties. 


o Completeness: Let Spartial = (p, M1442) be a partial \-register strategy for YintroHide: 
which is also a real commuting EPR strategy, and for which 
He ae Z Z 8, 
Man oni = > I; & Toi 8...8 Tok & Aas E 


s€Surfacesy 
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Flip an unbiased coin b ~ {0,1}, and perform one of the following three tests with probability 1/3 


each. 


1. Distribute the questions as follows: 


o Player b: Give (L, Z,...,Z,x); receive (O,v1,...,Ux, 2). 
——— 


k 


o Player b: Give (Z,Z,...,Z,x); receive (a1, v1, ..., Uk, a4). 


Accept if ag = a4 


k 


2. Distribute the questions as follows: 


o Player b: Give (L, Z,...,Z,x); receive (Ø, v1,..., Uk, a2). 
CA 


o Player b: Give (L 


Accept if az = ab. 


k 
,Z,...,Z,2,{X}); receive (Ø, v1,-.., Uk, a9, {0} 1 
k 


3. Distribute the questions as follows: 


o Player b: Give (X, Z,..., Z, Ø); receive (@1,U1,...,Uk, Ø). 
——— 


k 


o Player b: Give (L, Z,..., Z, L, {X}; receive (Ø, v4, ..., 01, Ø, {a4 4,--- 
\ : , ? 


Accept if v; = v; and 


a‘; = Vi: a for alli € {1,...,k}. 


4. Distribute the questions as follows: 


o Player b: Give (L, x, Z,...,Z,{X}); receive (@,v1,...,Vx%,@2,{@1,1,---,@1,4}). 
——— 


k 


o Player b: give (L,1,Z,...,Z,{X}); receive (Ø, v, ..., 0, Ø, {a4 1,-..,a4 p} 
N 1 > ? 


k 


Accept if a1; = a}; for alli € {1,...,k}. 


Figure 6: The introspected partial data-hiding game Mntrotide(A, £). 
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for some measurement Aq” acting only on the aux register. Then there is a value-1 X-register 
strategy for AntroHide extending Spartial which is also a real commuting EPR strategy. 


o Soundness: Let S = (y, M) be a projective \-register strategy passing YntroHide with prob- 
ability at least 1—e. Then there exists an ideal measurement Mit oy, a. With the property 


that 
Z Z 
ME vaz = Toi 8...8 Top & y I, & (Ma Jaux , 
s€Surfaces, 
such that the measurement Me A used by strategy S in response to the query (L, Z,..., Z, £) 


is close to MẸ v, az" 


(M7?) alice Q Ibob Se (ME) alice ® TBob- 


Proof. We first show completeness. Very similarly to the non-introspected partial data-hiding game, 
we introduce measurements for the remaining questions as follows: 
Z UA = A Z Z ,5, 
Malo iniz E 2 (ITs : Tay) & Tor 8...8 Top ® An E 
s€Surfaces, 


XZ, Z __X Z Z 
Mao o ay = Ta BT, Q- 8 To, Q Tg 


1,Z,...,Z,0,{X } —_ v X Z Z T,S,U 
M Uh A2 {A115 01, k} > (IE; - TI )® Ty, B -B To, @ Aa, 


Vi,a1-vj=a1 i] 


©,v1,. 

s€Surfaces, 
1,Z,...,Z,{X } — +X Z Z 
DU1 -Uk D, {01,1301} TVi, ai vi=a1,:] @ Toi @... Top: 


By essentially the same arguments as in the proof of Theorem 10.4, it follows that these measure- 
ments define a value-1 real commuting EPR strategy for Gptrotide: 

We now show soundness. Suppose that the provers succeed in the game with probability 1 — e 
using a A-register strategy. From the definition of a register strategy, we know that the measurement 
operators used by the provers have the following form. 


Mee a = (Ag * ) 9 ain & 7E QD 8 a 
Ma E = (Bas tal sal, ,}) beaux QI BOT, 
Moo = Ta 8 Ta Perec) ti 8 (Caa tk) iix; 
T A a A ® Ty @ ++ TH 


where the operators {Ag} 10E}, {Bop y% yh {Gag errr and {Dai sayy form valid 


a2,{0} 1501 k 
POVMs for every choice of £x, a1,v1,..., Ug. We further know that the shared state of the provers 


is of the form 
IV) = |EPRZ), 8 |EPRz), 8 @ |EPRZ), @ laux) aux- 


From success in the four parts of the test, we may also deduce the following conditions: 


LZ, Z, = Z, Z, Za 
(M, Jatice @ IBob ~e Taice 9 (Mir iaa) Bob» 


42 ,U1,+-+,Uk 
1,Z,...,Z,0,{X } 
Mastaa )s 


(ME?) alice D IBob ~e Iatice @ 
L,Z,...,Z,1,{X} 
( E TR) 
(MDZ 


KA x Z Z 
Alice © Bob ~e Lalice ® C il 8 Tor 8...8 Top & J sie) Bobs 
UL yes Uk {1,1 5-+541,4 } ( 


Mb erat XF 


ac he ea dee aaa BOR 


Alice 8 Bob ~e Lalice ® 
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We would now like to argue that the operators A, B,C, D form a good strategy for the partial 
data-hiding game. By Fact 12.3, it holds that under the uniform distribution over vj,..., Uz, 


,V1 00550 SS : Z Tai, Vi; -Uk 
(aS i E )Alice & IBob —e Inlice ® ( > Tay ® Caz ae see 


ay 


L,U1;.. U ad i eae 
(AG k ) Alice & IBob “e I Alice & (Ba : ”*) Bob’ 


(Bees  JAlice Q IBob “aie OLD, ) Bob 


{1,1,---,41,4} {@1,1,---,41,k} 
( Ul, Uk 


Ag . X 
falena „J Alice 8 IBob >e Í Mice Q (exer a cyanea, 9] Q Taux) Bob, 


as well as the same conditions with the Alice and Bob registers exchanged. 
These are precisely the conditions of winning the partial data-hiding game %jiqe(S,x), where 
S is the set of all tuples v,...,v% in Fj, with probability 1 — O(e). Hence, by Theorem 10.4, it 


follows that there exists a measurement Ae such that 


Alb Phyo ith = ` TI? @ ASTY, 


s€Surfaces, 


(AZE?) Alice Q IBob Se (AR ate Q Ison: 
The operator M’ in the conclusion of the theorem can then be taken to be 


IL Z 00; E ILU; Z Z 
M SA) OTa OO To O 


A2,U1,---;Uk 


13.2 An introspective surface sampler 


In this section, we will use the introspective data hiding game to implement the “surface prover”. 
This is a prover who samples a surface s from register 0 using the II” measurement and then 
reports back s to the verifier, along with a degree-d polynomial f : s > F,. As above, the prover 
is expected not to measure register 0 any further, so that f depends only on s and v. We can 
enforce this by running the introspective data hiding game and interpreting the provers’ answers 
as a2 = {s, f}. However, we must also verify that s corresponds to the actual surface measured by 
the prover in the 0-th register and not some other surface. We do this with a slight modification 
to the introspective data hiding game we call the “introspective surface sampling game”. 


Definition 13.3. Let k,n,d > 0 be integers, let q be a power of 2, and let A = (k + 1,n,q) 
be register parameters. Then the introspective surface sampling game ntroSurfSamp(A, d) is given 
in Figure 7. 


o Play the game Yptronide(A, £) with x = “surface”, and with the answer az taking the form 
{s, f}, where s is a surface and f is a degree-d function f : s > Fy. 


o Consider the test in Item 1 of Gptroniae(A, £). Here, Player b replies with the answer 
(@,v1,...,vx,{8, f}), and Player b replies with (a{,v1,..., Uk, {s’, f'}). In the case where 


this test is chosen, accept if MntroHide(A, £) accepts and also if s is the surface {a} ye NV; 
A1,- --, Ap E Fa}. (We call this additional check the “Correct Surface Check”.) If this query 
is not given to the provers, then accept if GntroHide(A, £) accepts. 


Figure 7: The game YntroSurfSamp (A, d). 
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Notation 13.4. In the case when a prover is given the question (L, Z,...,Z, “surface” ), we refer 
to it as the surface prover. It has the following intended behavior. 


1. Surface prover: 


Input: Pauli basis queries (L, Z,...,Z) and an auxiliary query “surface”. 
———’ 


k 


Output: Pauli basis answers Ø and vj,...,uz, E€ F? 


q ? 
coefficients of a degree-d polynomial function f : Fe — F, where the domain of f is to 


interpreted as s. 


a k-dimensional surface s, and the 


Goal: The prover measures II” on register 0 and sets s to be its outcome. They then set 


f = g|s, where g : Fy —> F4 is a global degree-d polynomial selected independently of s 


Or v. 


In the case when k = 1, we may also refer to it as the lines prover, and in the case when k = 2, we 
may also refer to it as the planes prover. We will also refer to the surface prover’s measurement, 
which refers to the measurement {A,,,..,,s,f} given by 
1,Z,...,Z, “surface” 
Ay ,...06,8,f = Ø, V1, Uks, f 
The following theorem shows that the introspective surface sampling game forces the surface 
prover to output the correct surface s. 


Theorem 13.5. Let k,n,d > 0 be integers, let q be a power of 2, and let A = (k+1,n,q) be register 
parameters. Write {Av,,....vp,s,f} for the surface prover’s measurement. Then G@ntroSurfSamp ‘= 
@ntroSurfSamp(A, d) has the following two properties. 


o Completeness: Suppose there is a degree-d polynomial g : Fj — Fq such that 


Avi... vps, = I; 8 T 8 a @ ee @ Taux : 1[f = gls]. 


Then there is a value-1 -register strategy for AntroSurfSamp With A as the surface prover’s 
measurement. 


o Soundness: Let S be a projective -register strategy which passes @ptroSurfSamp With proba- 
bility at least 1 — e. Then there exists an ideal measurement A' of the form 


pap OTe ©... 0T Q (MP Jaus 


with Mp” an arbitrary measurement on the aux register, such that A’ is close to the surface 
provers’ measurement A in S: 


(Av,s,f)Alice & IBgob ~poly(e) (Ap,s,f)Alice & IBob- 
In particular, the surface output by A’ is the same surface measured by A’ in register 0. 


Proof. First, the completeness follows immediately from the completeness guarantee of Theorem 13.2. 

Next, we show soundness. Passing with probability 1 — «€ implies passing Mptronide(A, “surface” ) 
with probability 1 — e. By Theorem 13.2, this implies an ideal measurement My if With the 
property that 


gee Uk;S 


Mi), usi = TEO O72 ® >> BoM ajs 


s’€Surfaces, 
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Flip an unbiased coin b ~ {0,1}. Distribute the questions as follows. 


o Player b: Give (L, Z,..., Z, “surface” ); receive (9,v1,..., Uk, S, f). 
k 


o Player b: Give (Z, H,..., H, “point” ); receive (u, Ø,..., Ø, v), where v € Fy. 
k k 


Accept if f(u) =v. 
Figure 8: The game GintroCross(A, d). 


(Aoy,...v4,8,f Alice 8 Bob Se (Mi, ...u4,8,f Alice ® IBob- 


(Note that the measured surface s’ in M’ is allowed to be different than the output surface s.) 
Next, set Bui, ups = If ® To Q-++@ TA ® laux- Then passing the Correct Surface Check with 
probability 1 — O (e) implies that 


(Av,s)Alice Q Ipoh Me Taice Q (Bu,s)Bob- 


Note that M; s,f and B,,; commute. Thus, if we define Cy. f := M; sf - Bys = Boge M! then 


by Fact 4.20, a 
(Av,s,f)Alice D IBob = (Av,s,f * Av,s)Alice ® Bob 

e (Ausf) Alice ® (Bu,s) Bob 

e (M;,s,f)Alice ® (Bu,s) Bob 

e (Mis, © Bu,s)Alice ® Bob 

(Cv,s,f)Alice Q Bob, 


Q 


Q 


Q 


where the second-to-last step is by Fact 4.38. Now, set Cre = My. Then we can write 


Cor, uk s,f =I; 8 Ta. D 8 T 8 (CP Jaux 


These matrices are almost of the form guaranteed by the theorem, except they do not necessarily 
form a measurement because the matrices C?” do not necessarily sum to the identity. However, 
this is still sufficient to imply the theorem by Fact 4.25. O 


13.3 The introspective cross-check 


In this section, we introduce the other subroutine in the introspective low-degree test. In this 
subroutine, known as the “introspective cross-check”, we introduce a new prover known as the 
“points prover”. This is a prover who samples a point u from register 0 and then reports back a 
value v € F, interpreted as their assignment to the point u. By data hiding, we can assume the 
points prover does not read registers 1 through k. Then the introspective cross-check queries the 
points prover and the surface prover and checks that their outputs agree on the point u. 


Definition 13.6. Let k,n,d > 0 be integers, let q be a power of 2, and let A = (k + 1,n,q) be 
register parameters. The introspective cross-check, denoted ptroCross(A, d), is defined in Figure 8. 


Notation 13.7. In the case when a prover is given the question (Z, H,..., H, “point”), we refer 
to it as the points prover. It has the following intended behavior. 
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2. Points prover: 


Input: Pauli basis queries (Z, H,...,H) and auxiliary query “point”. 
Output: String u € Fj and 9,...,@. A number v € Fy. 


Goal: The prover sets v = g(u), where g : Fj — F; is a global degree-d polynomial selected 
independently of u. 


We will also refer to the point prover’s measurement, which refers to the measurement {Bu} given 
by 
ie aaa 
Our next lemma shows that if the surface prover’s measurement for f depends only on the 
surface s and directions v and not on the point u, then we can relate the value of the introspective 
cross-check to its non-introspected variant, surface- 


Lemma 13.8. Let k,n,d > 0 be integers, let q be a power of 2, and let A= (k +1,n,q) be register 
parameters. Let S be a -register strategy for AntroCross = “mtroCross(A, d). Let {Au s,f} be the 
surface prover’s measurement and {Bu u} be the point prover’s measurement, and write |aux) for 
the auxiliary state. Suppose 


Av,s,f =Ie7, 6-677 8AF”, 


Buy =T @1@...®1@Br", 
k 


where {A%"} and {B“} are POVM measurements on the auxiliary register. Consider the strategy 
Ssurface = (aux, {A8 , B”}) for the game Bourface := Grace. d). Then 


valg artaco (Ssurface) = Val, ntrocross (S) * 


Proof. By the definition of II? and 77, it follows that for any choice of k vectors v, if Alice and 


Bob each measure their half of register 0 using the measurements II” and 7,7, respectively, then 
the measurement outcomes obtained will be pairs (s,w) where s is a uniformly random surface in 
Surfaces, and u is a uniformly random point in s. Moreover, if Alice measures her half of registers 1 
through k, she will obtain a uniformly random k-tuple v = {v1,...,uz} C Fj. Combining these 
facts, we see that if Alice measures her half of registers 0 through k with II? & To ®...8 T and 


Bob measure his half with 7# & I Q... Q I, they obtain a pair of outcomes (a4 = (s, v), £B = u) 
——— 


k 
distributed exactly according to the question distribution in %urface. Thus, applying Fact 12.2, we 
conclude that valg, stace (Ssurface) = VIF prirocross (S). o 
13.4 The introspective low-degree test 
In this section, we state the completed introspective low-degree test. 


Definition 13.9. Let k,n, d > 0 be integers, let q be a power of 2, and let À = (k+1, n, q) be register 
parameters. The introspective surface-versus-point low-degree test, denoted ¥ := AntroLowDeg (A, d), 
is defined in Figure 9. It has the following properties: 


Q-length(¥Y) = O(1), A-length(Y) = O(kn log(q) + (d + k)* log(q)), 


Q-time(Y) = O(1), A-time(Y) = poly(kn log(q), (d + k)" log(q)). 
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With probability 2 each, perform one of the following three tests. 


1. Surface sampler test: Play MutrosurfSamp (A, d). 


2. Cross-check test: Play fintroCross (À, d). 


Figure 9: The game YntroLowDeg (A, d). 


The question complexities are immediate. As for the answer length, the provers return (k + 1) 
elements of Fý and degree-d polynomials on k-surfaces, encoded as F,-valued strings of length 
d{k] < (d+k)*. Finally, all operations made by the verifier, such as polynomial evaluation, are 
efficient, so the answer time complexity is polynomial in the answer length. 

Naturally, we analyze the introspective low-degree test via introspection. This involves a reduc- 
tion to the non-introspected version of the game, i.e. the “normal” surface-versus-point low-degree 
test. By Theorem 4.40 we know quantum soundness for this test in the k = 2 (i.e. planes) case. As 
a result, we get soundness for the introspective low-degree test in this case as well. 


Theorem 13.10. Fix k = 2. Letn,d > 0 be integers, let q be a power of 2, and let A = (k+1,n,q) 
be register parameters. Write G := GntroLowDeg (A, d). 


o Completeness: Suppose there is a degree-d polynomial g : Fý > Fq such that 
Buy = TŹ @ l 8h 8 hau: Liv = glu). 


Then there is a value-1 A-register real commuting EPR strategy for Y with B as the point 
prover’s measurement. 


o Soundness: There exists a constant c > 0 and a function â(€) = poly(e,dm/q°) such that the 
following holds. Suppose S is a projective A-register strategy with value 1 — e. Write {Buv} 
for the point prover’s measurement. Then there exists a POVM {Gg} in PolyMeas(n, d, q) 
such that 

(Buv)alice ® IBob Sle) (TE 9 L 8 D 8 (Gig(u)=v} )aux) Alice ® Ipob- 


Proof. Throughout this proof, we will write {Ay s,f } for the surface prover’s measurement. We first 
show completeness. Assign the surface prover’s measurement as follows: 


Araf = Uy ®@ Ty, @ Ta O Ta Uf = gle. 


This is clearly a A-register strategy. By the completeness case of Theorem 13.5, this can be ex- 
tended into a real commuting EPR strategy that passes YptrogurfSamp(A,@) with probability 1. 
By Lemma 13.8, the strategy using A and B passes the cross check with the same probability as 
the honest classical strategy to Gsurface(n, q, k, d) answering according to the low-degree polynomial 
g, which is 1. Hence, this strategy passes both parts of Y with probability 1. 

Now, we show soundness. The strategy S is a A-register strategy, so we can write the points 
prover’s measurement as 

Buy = ro ® Ll & h & (Bo )aux: 


Passing MntroSurfSamp(A, d) with probability 1 — 2e implies via Theorem 13.5 a measurement Alv, f 
such that 
vaf = I} Q te; &® Ta, Q (A)? Jaux 
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(Av, s,F Alice Q Bob Spoly(e) (Ai,s,p)Alice 8 IBob, 
where {(A’ ye} f is a measurement on the auxiliary register. By assumption, the measurement 
{Auv s,f} is projective, so we can apply Fact 4.31 to deduce that replacing Ay,s¢ by A, af changes 
the game value by at most poly(e). Moreover, by applying Theorem 4.2, we can, by performing a 
dilation of the auxiliary space, simulate the Ay s,f Measurements by a projective measurement of 
the form 
Ausf = Us @ Ty, On @ ((A") e 


where (A” ye is a projective measurement on the (expanded) aux register. (Note that a direct 
invocation of Naimark’s theorem Theorem 4.1 would not have sufficed as the dilated measurement 
would not necessarily act as desired on the non-aux registers.) Using the dilated A” measurements 
instead of A’ does not change the value of the game. Thus, we deduce that the projective strategy 
using measurements Bu, and A; s,f Passes GtroCross(A, d) with probability 1 — poly(e). 

Now we are in a position to reduce to the soundness of the non-introspective game. Define 
the strategy Splane := (aux, {BY, (A”)*”}). Then by Lemma 13.8, Spjane also passes plane with 
probability 1 — poly(e). Applying Theorem 4.40, we have that there exists a measurement {G4} in 
PolyMeas(n, d,q) such that 

By 8 1 Sate) Gy=gw] 8 I 
on state |aux). 
The theorem then follows from Fact 12.3. O 


13.5 The introspective simultaneous low-degree test 


In this section, we extend the introspective low-degree test to handle multiple functions at once. 
This is the introspective version of the simultaneous low-degree test from Definition 3.13. 


Definition 13.11. Let m > 1. Let k,n,d > 0 be integers, let q be a power of 2, and let À = 
(k +1,n,q) be register parameters. The introspective simultaneous low-degree test, denoted Y := 
FntroLowDeg(A, d, m), is defined by the following modifications to the introspective low-degree test. 
First, the prover roles are modified as follows. 


o Surface prover: Rather than returning a function f : s > Fy, it should return m functions 
fi,--->fm:8— Fy. The intent is that f; = gi|, for each i, where each g; : Fj > F; is a global 
degree-d polynomial selected independently of s or v. 


o Points prover: Rather than returning a single number v € F}, it should return m num- 
bers v1,...,Vm E Fy. The intent is that v; = gi(w) for each i, where each g; is selected 
independently of u. 


Next, the subroutines are modified as follows. 


o Introspective surface sampling game: The answer az has the form s, f,,..., fm (rather 
than s, f for a single function f). 


o Introspective cross-check: Receive f,,...,f;, : S — Fq from the surface prover and 
V1,...,Um E Fy from the points prover (rather than a single f and v). Check that f;(w) = vi 
for all i. 


It has the following properties: 
Q-length(Y) = O(1),  A-length(Y) = O(kn log(q) + m(d + k)" log(q)), 
Q-time(¥Y) = O(1), A-time(Y) = poly(kn log(q), m(d + k)" log(q)). 
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The following theorem gives the performance of the introspective simultaneous low-degree test 
in the case of k = 2 (i.e. planes). 


Theorem 13.12. Fix k = 2. Let n,d,m > 0 be integers, let q be a power of 2, and let X = 
(k+1,n,q) be register parameters. Write GY := GntroLowDeg (A, d, m). 


o Completeness: Suppose there are degree-d polynomials g1,..., gm : FG > Fq such that 


Buy jen = TA 8 11 8 h 8 aux: 1[vi, y= gi(u)]. 


Then there is a value-1 A-register real commuting EPR strategy for GY with B as the point 
prover’s measurement. 


o Soundness: There exists a constant c > 0 and a function 6(€) = poly(e,d(n + m)/q°) such 
that the following holds. Suppose S is a projective A-register strategy with value 1 — e. Write 
{Bunium} for the point prover’s measurement. Then there exists a POVM {Gg gm} 
in PolyMeas(n, d,q,m) such that 


(Buri, vm )Alice @ Lec Sfo) (TE 8 11 8 D 8 (Gigi (u)... gm(u)=v1,.. vm] awed Alice Tob 


The proof, which we omit, is analogous to the proof of Theorem 13.10, except rather than 
reducing to Theorem 4.40, we reduce to the soundness of the non-introspective simultaneous low- 
degree test given by Theorem 4.43. 


14 The intersecting lines test 


The introspective low-degree test forces a prover to sample a point from a register and return the 
evaluation of a global function at that point. In our eventual protocol, we will want the prover to 
use the same global function to answer point queries sampled from multiple different registers. In 
this section, we design a game which allows us to “transfer” global functions used from one register 
to another. We keep in mind the following picture: 


IY) = [EPR7);] 8 |EPR7), © laux} 


aux ' 


We view register 1 as the register with the global function and register 2 as the register we would 
like to transfer this global function to. 

To accomplish this, we introduce a new test called the “intersecting lines test”. This involves 
performing two introspective line-versus-point low-degree tests. The first uses register 1 as its 
point register and register 2 as its slope register. This gives us a points prover who samples u from 
register 1 and returns a label on it and a line prover who samples v from register 2 and returns 
a function on the line {u + Av}, and we know that if the points prover labels their point using a 
low-degree polynomial g, then the line prover must label their line with the same polynomial g. 
The second low-degree test uses register 2 as its point register and register 1 as its slope register. 
This gives a second line prover who returns a function on the line {v + Au}. Noting that the point 
u +v is contained in both line provers’ lines, we can check consistency between their functions by 
comparing them on this point, forcing the second line prover to label their line using g as well. 
This then entails that the second line prover from the second low-degree test must also label their 
point v using g. Thus, we have successfully “transferred” the function g from the first register to 
the second. 

In Section 14.1, we first introduce the intersecting lines test and prove soundness. Following 
that, in Section 14.2 we introduce an introspective version of this test which will later be used in 
our NEEXP protocol. 
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14.1 The intersecting lines test 


Definition 14.1 (Intersecting lines test). Let n,d > 0 be integers, and let q be a power of 2. 
The intersecting lines test, denoted GYntersect (N, q, d), is defined as follows. Sample u, v uniformly at 
random from F?, and let £ and £’ be the two lines £ := {u+Av : \ € Fy} and £! := {u+Au: A € Fy}. 
The test is performed as follows. 


o The line £ and v are given to Alice, who responds with a degree-d polynomial f : £— F4. 
o The line Z’ and u are given to Bob, who responds with a degree-d polynomial f’ : V > F}. 
Alice and Bob pass the test if f(u + v) = f/(ut+v). 


We begin by showing that although Bob knows u, since he doesn’t know v, the point u + v 
looks like a uniform point in ’ to him. 


Fact 14.2. Conditioned on £! and u, the point u +v is distributed as a uniformly random element 
in l. 


Proof. Let w be a point in Fj such that f= {w+ Au: € F}. Then for any c € F}, V is also 
equal to the set {(w + cu) + (à — c)u : A € Fj}. Hence, v is equally likely to be any element in the 
set {w + cu : c € F,}, and therefore so is u +v. Since this set is also equal to l’, this proves the 
fact. O 


We will be interested in the case when Alice responds using a global function g : Fj — Fy, always 
setting f = gle. In this case, the following lemma shows that to succeed with high probability, Bob 
must usually play the same global function as Alice. 


Lemma 14.3. Let (w,M) be a POVM strategy for the intersecting lines game with value 1 — e. 


Suppose further that there is a measurement {Gg}, in PolyMeas(n, d,q) such that Mọ” = Gig=f]: 
Then , 
(M; alice @ IBob ~e+a/q TAlice ® (Gig|,,=F))Bob- 


Proof. Success on the test implies that 
l, 
(Gig(u-+v)=v] Alice ® IBob ~e Latice © (Mir i+v)=v]) Bob- 


But by Fact 14.2, conditioned on @’ and u, u + v is distributed as a uniformly random point in Z. 
As a result, if we let w be a uniformly random point in Z’, then 


(Gio(w) =v] ) Alice 8 IBob ~e Lalice © (M aoi Bob: 


The lemma then follows from Proposition 4.42. O 


14.2 The introspective intersecting lines test 


Now we introduce the introspective intersecting lines test. This will be an introspective version of 
the intersecting lines test. 


Definition 14.4. Let n,d > 0 be integers, let q be a power of 2, and let A = (2,n,q) be register 
parameters. The introspective intersecting lines test, denoted Gntrointersect (A, d), is a A-register game 
involving two registers, named “1” and “2”, and a possible third auxiliary register. It involves two 
line-versus point low-degree tests, instantiated as follows. 
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With probability i each, perform one of the following four tests. 


. Low degree test 1: Play %. 
. Low degree test 2: Play %. 


. Intersecting lines test: Flip an unbiased coin b ~ {0,1}. Assign the first role to Player b 
and the second role to Player b. 


o Lines;: Receive £, v, f : l — Fy. 


o Linesz: Receive ’, u, f’: V > Fy. 
Accept if £ and £’ both contain u +v and f(u +v) = f(u +v). 
. Consistency test: Assign the first role to Player 1 and the second role to Player 2. 


o Points;: Receive v. 


o Pointsi: Receive v’. 


Accept if v = v’. 


Figure 10: The game Hintrointersect (A; d). 


o Let Gı be a copy of GntrotowDeg (À, d) using register 1 as the point register and register 2 as 
the slope register. Write Lines; for the surface prover in G,; and write Points; for the points 
prover. 


o Let G2 be a copy of GntroLowDeg(A, d) using register 2 as the point register and register 1 as 
the slope register. Write Linesg for the surface prover in G2 and write Points for the points 
prover. 


Then Gptrotmtersect (A, d) is defined in Figure 10. 


Remark 14.5. We remark that although the test runs two separate introspective low-degree tests, 
we cannot from these alone conclude that either of the points provers answers according to a 
global function. This is because we use the lines (k = 1) introspective low-degree test, whereas 
from Theorem 13.10 we only know soundness for the planes (k = 2) introspective low-degree test. 
Hence, proving soundness for the introspective intersecting lines test will require an additional 
assumption, i.e. that one of the two points provers already answers queries according to a global 
function. 


Our main result about the introspective intersecting lines test is the following theorem. 


Theorem 14.6. Let n,d > 0 be integers, let q be a power of 2, and let A = (2,n,q) be register 
parameters. Write F := Yntrotntersect(A, d). Write A for the point prover’s measurement in Y,, and 
write B for the point prover’s measurement in Ú. 


o Completeness: Suppose there is a degree-d polynomial g : FG — Fq such that 
Aga = ao 8 h @ lax: 1v = glu), Biv =h 8 TŽ @ Jaux: Liv = g(v)|. 


Then there is a value-1 A-register real commuting EPR strategy strategy for Y extending A 
and B. 
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o Soundness: There exists a function 6(€) = poly(e,d/q) such that the following holds. Let 
S be a projective A-register strategy which passes GY with probability 1 — e. Further, suppose 
that there exists a projective measurement {Gg}q in PolyMeas(n,d,q) acting on the auxiliary 
register such that 
Auw = A & h & Gigu)=v]: 
Then 
(Bov )Alice ® IBob *5(e) (I1 ® TY ® Gig(v)=r]) Alice ® TBob: 
Furthermore, 
Q-length(Y) = O(1), A-length(Y) = O(n log(q) + dlog(q)), 
Q-time(Y) = O(1),  A-time(¥Y) = poly(nlog(q), dlog(q)). 
Proof of Theorem 14.6. The runtime and communication complexities follows from the k = 1 case 
of the low-degree test. The completeness follows immediately from the completeness of the intro- 
spective low-degree test. 


Now, we show soundness. Write C for the line prover’s measurement in Y¥,, and write E for the 
line prover’s measurement in %. We can write the point provers’ measurements as 


Auy =TZ@bR@G wa, Boy =h@re @ Be. 
The strategy passes the consistency test with probability 1 — d(€). As a result, 
Auv ® Ibob ~5(c) Ialice B Au,v- 
By Fact 12.2, this implies that 


Gig(u)=v] Q IBob ~5(c) LAtice @ Gig(u)=v] (63) 


on state Jaux) and the uniform distribution on Fj. By Fact 4.26, this implies that 


Gigle=f] 8 IBob ~5(e) Lalice ® Gig|p=f)> (64) 


where £ is distributed as £ = {u + Av: À € Fy} for uniformly random u,v € Fọ. 
Next, the strategy passes both introspective low-degree tests Y and % with probability 1—0d(e). 


By Theorem 13.5, this implies measurements Oo") and pE” on the auxiliary register such that 
f f 


(Cov,f Alice @ IBob 5(c) (1; ITÉ Q c$’) aar IBob, (65) 


(Ev u,f')Alice ® IBob 5(e) k (04) Iy Q EY") ie ® IBob: (66) 


By Fact 4.32, we can assume Equation (65) holds with equality, incurring a loss of only 6(€) in the 
game value. (We will do the same for Equation (66) later.) 

The strategy is now in a form that allows us to apply Lemma 13.8 to the introspective cross- 
check in ¥,. This implies that the measurements G'ig(uj=y] and o7 give a good strategy for the 
line-versus point test. In other words, 


Cku 8 IBob ~5(6) I alice 8 Gig(u)=v]: 
on state |aux). By Proposition 4.42, this implies that 


ce ® IBob 5c) Talice D Gjgle= f]: 
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Via Equation (64), this implies 
Ce ® IBob ©5(c) Ialice D Gigip=f] 5(e) Clgle=f] 8 Bob- 
As a result, by Fact 12.3, 
(Cow,p)atice ® IBob Sace) (I? 8 77 ® Gig,— sf) )alice ® IBob- 


By assumption, the right-hand side is projective. As a result, by Fact 4.32, we can assume this 
expression holds with equality, incurring a loss of only 6(e€) in the game value. Following this, we 
apply Fact 4.32 again to assume Equation (66) holds with equality. 

The distribution given by on (¢,v) and (¢’,u) when we measure with C and E is exactly the 
question distribution of the (non-introspective) intersecting lines test. As a result, Fact 12.2 implies 
that the measurements Gi,,— ,) and EA pass the intersecting lines test with probability 1 — d(e). 
In other words, 


ge=f 

t, 

E pi(utv)=r) © TAlice ~5(c) IBob @ Gig(utv)=v)- 
on state jaux). Then by Lemma 14.3, 
Ep" ® TBob ~fe) Taice ® Cgiy=/') 
Via Equation (64), this implies 
Ep" ® IBob Sse) Taice ® Glgle=f'] ~ale) Clgle=f'] 8 TBob: 
Thus, Fact 12.3 implies that 
(Ev u,f')Aalice @ IBob Sale) (Ta @ Uf S Gliglu=f1) aice @ Bob- 


By assumption, the right-hand side is projective. As a result, by Fact 4.32, we can assume this 
expression holds with equality, incurring a loss of only â(€) in the game value. 

The strategy is now in a form that allows us to apply Lemma 13.8 to the introspective cross- 
check in %. This implies that the measurements By and Gigy (v)=v] = Gig(v)=r] give a good strategy 
for the line-versus-point low-degree test. In other words, 


By ® IBob ~6(c) Lalice D Gfg(v)=1]- 
on state |aux). Via Equation (63), this implies 
By ® Igob ©65(c) Ialice D Gig(v)=v] Sêl) Gig(v)=r] Q IBob- 
As a result, by Fact 12.3, 
(Buy) alice ® IBob Sifo) (I1 D TY ® Gigv)=r]) alice ® IBob- 


This completes the proof of the theorem. O 
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15 The introspective NEEXP protocol 


In this question, we give the complete short-question, introspective NEEXP protocol. The goal is a 
protocol for Succinct-Succinct-3Sat instances of size sinst with poly (sinst) question length and run- 
ning time and poly(2*ist) answer length and running time. Our construction will be an introspec- 
tive version of the classical PCP construction from Section 11, in which we replace the low-degree 
tests and simultaneous low-degree tests with our introspective low-degree test and introspective 
simultaneous low-degree test. 

We summarize the protocol here. Given the Succinct-Succinct-3Sat instance Cingt of size Sinst, 
let C be the size-s, (3n + 3)-input Succinct-3Sat instance it succinctly represents, where s and n are 
roughly exponential in sins. Following Section 11, we would like the introspective prover to sample 
strings ©1,%2,%3 € Fj’ and (b, w) € ner , which they should return to the verifier. In addition, 
they should return the evaluations g(a1), g(x2), g(#3) and c (x, b, w),..., Cm (x, b, w), where g and 
the c,;’s are purported degree-d polynomials. This suggests using the following registers: 


|EPR™), S |EPR™), © |EPR™), ® |EPR3**),. 


The difficulty in this protocol is ensuring that the polynomials involved are low-degree. To begin, 
we can run the introspective low-degree test on the first register, which guarantees that g(a ) 
corresponds to a low-degree polynomial. Doing the same on registers 2 and 3 would guarantee the 
functions evaluated on x2 and 23 are also low-degree polynomials, but it would not guarantee that 
the prover is using same low-degree polynomial g on all three. Instead, we run the introspective 
intersecting lines test twice, ensuring that prover evaluates £1, £2, and #3 using the same function g. 

Next, we consider the coefficient polynomials c,,...,Cm’. They are evaluated on the concate- 
nated outputs of the four registers, i.e. the string (a,b, w). As a result, we view the four registers 
as a single superregister of length m’ = 3m + 3 + s, and we would like to perform the introspective 
simultaneous low-degree test on this superregister. However, this test requires two additional su- 
perregisters of length m’ to serve as the direction registers. As a result, the shared state between 
the two provers will be of the following form: 


|) = (JEPR{'),) ® |EPR;'), ® |EPR;'), ® [EPR °) ,)superReg! 
8 (|EPR?"),.)superReg2 ® (|EPR?” ) .)superReg3 ® |AUX) aux 


Having checked that the provers’ functions are low-degree, we conclude with a consistency check 
between g and the c;’s to ensure that they encode a satisfying assignment to our Succinct-3Sat. In 
Section 11, this was done by the “formula test”, i.e. the check that saty (æ, b, w) = zeroy,-(x, b, w). 
Here, this will be accomplished by an introspective version of this test, in which the provers sam- 
ple x, b, and w themselves. Passing this test with high probability proves that Cingt is a YES 
instance of the Succinct-Succinct-3Sat problem. 

This section is organized as follows. In Section 15.1, we will discuss the register parameters 
algorithm, needed for the register compiler from Section 5. Next, Section 15.2 introduces the intro- 
spective formula game. Finally, Section 15.3 completes the construction and gives the introspective 
NEEXP game. 


15.1 Computing the register parameters 


Given the Succinct-Succinct-3Sat instance Cinst of size Sinst, let C be the size-s, (3n + 3)-input 
Succinct-3Sat instance it succinctly represents. To compile our protocol to one sound against general 
provers, we need a register parameters algorithm which runs in time poly(sinst) (Definition 5.9). 


94 


As described above, the register parameters will be simple functions of the numbers s and n (for 
example m, a simple function of n to be determined later). However, s and n themselves may not 
be easy to compute, as the natural way of computing them involves first computing C, a time 2°imst 
task. We solve this by “guessing” values for these numbers which are guaranteed to be larger than 
the actual values, and then later “fixing” the circuit C so that it actually has the guessed input 
length and size. This is detailed in the following definition. 


Definition 15.1. Let Cinst be a size-singt instance of the Succinct-Succinct-3Sat problem. 


1. Let C be the size-s Succinct-3Sat instance it succinctly represents. This circuit takes inputs 
i,j,k, each of some length n, and bits 6), bo,b3. Then s and n can both be trivially upper- 
bounded by N := 2°%inst, 


2. Consider a new circuit Cpaq with inputs i, j,k € {0,1}. and b € {0,1}8. We write i = (i1, i2), 
where 7; is of length N — n and 72 is of length n, and likewise for j and k. Let this circuit 
act as follows: 


o Compute the V of the bits in 71, jı, and kı. Output 0 if this is 1. 
o Otherwise, output Caec(t2, J2, k2, b1, ba, b3). 


As defined, this circuit has size s+3(N—n)+2 < 4N =: S, and we will pad it with additional 
gates in a trivial manner so that it has exactly S gates. It can be checked that it succinctly 
represents the same 3Sat formula as Caec- 


We set PadC(Cinst) := Cpaa, PadN(Cinst) := N, and PadS(Cinst) := 4- N. We note that given Cinst, 
the value of N is efficiently computable. 


15.2 An introspective formula game 


In this section, we introduce the “introspective formula game”. This game is the introspective 
version of the formula check in Section 11, in which we check saty g(x, b, w) = zeroy,.(a, b, w) on 
a randomly chosen point (a,b, w) in F”. Prior to stating the introspective formula game, we will 
begin by recalling what this notation means. 

Let Cinst be a size-(Sinst) Succinct-Succinct-3Sat instance. Let C = PadC(Cinst) be a Succinct-3Sat 
instance, and let n = PadN(Cinst) and s = PadS(Cinst). Then C is a size-s, (3n + 3)-variable circuit 
which is a YES instance of the Succinct-3Sat problem if and only if Cinst is a YES instance of the 
Succinct-Succinct-3Sat problem. Introduce h = 2"', q = 2, and m such that N = 2”, h, q, and m 
are exactly admissible parameters (Definition 11.1). Set n’ = n +3 + s and m' = m+3+ s. We 
also recall the following pieces of notation. 


o (Definition 3.8): Write H := Hz, tz- 


o (Definition 11.4): Given a function g : Fy — Fq, recall the notation saty, g := saty,g.n,t1,t2° 


o (Proposition 11.6): Writing Hyero = H?™ @ {0,1}3+s, Given c1,...,Cw : Dg — Fy, recall 
the notation zeroH,e = Zero Hero,c- 


Before stating the introspective formula game, we must first dispense with the following annoy- 
ing technicality. 
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Flip an unbiased coin b ~ {0,1}. 


o Player b: Give (Z, Z, Z, Z, “formula”); receive u1, u2, u3,(b,w) and v1, V2,v3 and 
His- -;HM'- 


Compute saty „ (u, b, w) and zerop,„ (u,b, w). Accept if they are equal. 


Figure 11: The game AintroForm (Cinst, h, q, m). 


Notation 15.2. In the classical case (Section 11), we have a fixed proof which contains fixed 
functions which may or may not be low-degree. In the quantum case, however, we are dealing not 
with a fixed proof but an interactive prover, and the formula prover may not respond based on fixed 
functions (their responses might be randomized, for example). To account for this, we modify the 
definitions of sat and zero as follows. First, we recall the notation gy := gy,n,tı‚to (Definition 11.3). 


o Given v1, V2, V3 € Fy, define 
saty (x£, b, w) := gy(z,b, w) - (v1 — b1) (v2 — b2) (v3 — b3). 


o Given H1,..., Um E Fg, define 


Zerog, (£) = ZEYO( Horo); (Li) * His 
i=1 


where by definition (Hero); = H for i € [3m] and (Ayero); = {0,1} otherwise. 


We note that if there is a function g such that v; = g(a;), then saty „ = saty g. Similarly, if there 
are functions cj,...,Cm such that ju; = c;(x), then zeroy,,, = zerozyc. 


Now we state the introspective formula game. 


Definition 15.3. Let Cinst be a size-(singt) Succinct-Succinct-3Sat instance. Let n = PadN(Cinst) 
and s = PadS(Cinst). Suppose n, h = 2", q = 2, and m are exactly admissible parameters. The 
introspective formula game, denoted F := YptroForm(Cinst, 2, q, Mm), is defined in Figure 11. This is 
a ACneq = (4,4, q)-register game, for £ = (m,m,m,3+s). Furthermore, 


Q-length(¥Y) = O(1), A-length(¥Y) = O(m’ log(q)), 
Q-time(¥) = O(1), A-time(Y) = poly(s,n, n’, h,q, m’). 
Notation 15.4. In the case when a prover is given the question (Z, Z, Z, Z, “formula” ), we refer 
to it as the formula prover. It has the following intended behavior. 
3. Formula prover: 


Input: Pauli basis queries (Z, Z, Z, Z) and auxiliary query “formula”. 


Output: Strings u1, u2,u3 € Fy’ and (b,w) € he, Three numbers 11, 2,73 € F} and m’ 
numbers p1, ..., Um E Ey. 


Goal: The prover should act as follows. 


o The prover sets vı = g(u1), v2 = g(u2), v3 = g(u3), where g : Fy — F; is a global 
degree-d; polynomial selected independently of u. 
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o They then set u; = c;(u1, U2, u3,b,w), where for each i, c; : ied — F, is a global 
degree-dz polynomial selected independently of (u, b, w). 


Here, dı and dọ are polynomial degrees which will be selected later. We will also refer to the 
formula prover’s measurement, which refers to the measurement {Fu b,w,v;,u;} Such that 


E — Z,Z,Z,Z,“formula” 
U,D,WV1V2,V3 M1 yb! T U,b, WV V2,V3 5H yest” 


We begin by showing the completeness case of the introspective formula game. 


Proposition 15.5 (Introspective formula game completeness). Suppose Cinst is a YES instance of 
the Succinct-Succinct-3Sat problem. Let a: {0,1}" — {0,1} be a satisfying assignment to the 3Sat 
instance it encodes, and let g := gq : Fj’ — Fq be its low-degree encoding. Let c1,..., Cm : Be >F, 
be the coefficient polynomials guaranteed to make saty g = Z€YOH,..,c by Proposition 11.6. Both g 
and the ci’s are degree-O(hn') polynomials. Consider the Ac -register strategy (p, A) with no 
auxiliary register in which 


inst; 


Z Z Z Z 
Au, bwv,u = Tu @ Tuy @ Tug 8 Th w` 1; = g(ui), Hj = Cj (u, b, w)), 


where the indices range over i € [3] and j € |m’]. Then this strategy passes @ntroForm (Cinst, h, q, M) 
with probability 1. 


Proof. This game is simply the oracularized version of the formula check in the classical PCP. The 
proposition follows from the discussion in Section 11.5. O 


Our next lemma covers the soundness case of the introspective formula game. It concerns provers 
of a particular form, namely those whose measurements correspond to low-degree polynomials. We 
show that if there exists such a prover with nonnegligible value, then the formula must be satisfiable. 


Lemma 15.6 (Formula game partial soundness). Let Cinst be a Succinct-Succinct-3Sat instance, 
and set Y := YntroForm(Cinst,h,g,m). Let S = (Y, A) be a Acin g- register strategy. Consider a 
measurement on the auxiliary register 


G = {GO g.¢1,.4¢p1F 


with outcomes degree-d polynomials g : Fj’ — Fq and degree-dz polynomials c1,..., Cm : Fn > Fy. 
Suppose A has the following form: for each u, w, V, and p, 


Aub wvu = Oo oe @ 7, 1,8 Ta w 8 ® (Ciais es) ae (67) 


where the subscript of the G measurement ranges over all i € [3] and j € [m]. If the probability S 


passes G is at least 
max{O(hn’) + 3d), h + d2} 


q 
then w is satisfiable. 


Proof. Consider the following three step strategy: 
1. Measure the auxiliary register with {G,c,,...,c,,}, receiving functions g, C1, ..., Cm- 


2. Measure the EPR registers in the Z basis, receiving u, b, and w. 
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3. Output u, b, w, g(u1), g(u2), gluz) and cı(u,b, w) through cm (u,b, w). 


This passes the formula game with probability valg(S). Then there exists functions g, C1, ..., Cm 
such that conditioned on measuring them in step one, this strategy passes with probability at least 
valg(S). By the remark at the end of Notation 15.2, this is the probability that 


Saty (a,b, w) = zerozz,-(@, b, w), 


where (x, b, w) is drawn from ie uniformly at random. The lemma follows from Lemma 11.7. O 


15.3 The complete introspective protocol 


In this section, we introduce the introspective protocol for NEEXP and prove its correctness. 
The introspective NEEXP protocol builds on top of the introspective formula game by using a 
series of introspective low-degree tests to ensure that the formula prover satisfies the condition in 
Equation (67). Having done this, we can then apply Lemma 15.6, ensuring that if a strategy passes 
with high probability, then the instance is satisfiable. 


Definition 15.7. Let Cingt be a size-(singt) Succinct-Succinct-3Sat instance. Let n = PadN(Cinst) 
and s = PadS(Cinst). The verifier chooses h = 2*1, q = 2", m, and d such that m, h, q, and m are 
exactly admissible parameters satisfying 


h=O(n), m=90 (5) , q=poly(n), d= O(hn’) = O(n”). 
(We will choose the polynomial for q in Theorem 15.8 below.) The verifier sets A = (6, £, q), where 
L= (m,m,m,3 + s,m’',m’). 
We begin by instantiating the following list of subroutines. 


o Let ALD = (3,m,q) be register parameters. Let Gp be a copy of YntroLowDeg(ALD, d), using 
register 1 as the point register and registers 2 and 3 as the direction registers. Write Points, 
for the points prover. 


o Let Ar, = (2,m,q) be register parameters. Let “fı be a copy of Gptrotmtersect (AIL; d) on 
registers 1 and 2 whose points prover for register 1 is Points; from Lp. Write Pointsy for the 
points prover on register 2. 


o Let frz be a copy of Yantrointersect (Ar; d) on registers 1 and 3 whose points prover for register 1 
is Points; from Lp. Write Pointss for the points prover on register 3. 


o Let Y be a copy of GntroForm(Cinst, h, q, M) on registers 1, 2, 3, and 4. Write Formula for the 
formula prover. 


o Let ALpsup = (3, m’, q) be register parameters. Let Y.psup be a copy of AntroLowDeg (ALDSUP; d, 3+ 
m’), applied to the following three superregisters: registers 1 through 4 are combined into 
the point superregister, register 5 is used as the first direction superregister, and register 6 is 
used as the second direction superregister. In addition, use Formula from {orm as its points 
prover. 


Then the introspective NEEXP game, denoted MntroneexP (Cinst), is defined in Figure 12. 


The main result Part IV is the following theorem. 
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With probability 4 each, perform one of the following nine tests. 
. Low degree test: Play @p. 
. Intersecting lines test 1: Play 41. 
. Intersecting lines test 2: Play G2. 
. Simultaneous low degree test: Play @,psup. 
. Formula test: Player Y. 


For the remaining tests, flip an unbiased coin b ~ {0,1}. Assign the first role to Player b and the 
second role to Player b. 


6. Consistency test 1: 


o Points;: Receive v. 


o Formula: Receive vı. 
Accept if v = nı. 
7. Consistency test 2: 


o Pointsg: Receive v. 


o Formula: Receive və. 
Accept if v = v2. 
8. Consistency test 3: 


o Pointss: Receive v. 


o Formula: Receive v3. 
Accept if v = v3. 
9. Consistency test 4: 


o Formula: Receive 71, V2, V3 and py,..., Hm- 


o Formula: Receive v|, v5, v3 and p),..., Hy 


Accept if v; = v; and p; = p} for all i € [3], j € [m]. 


Figure 12: The game fintroNEEXP (Cinst)- 
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Theorem 15.8. Let Cinst be a size-(Singt) Succinct-Succinct-3Sat instance. Let q be a sufficiently 
large poly(n) and € > 0 a sufficiently small constant such that Equation (72) is at least 5 and 
Equation (73) is less than 5. Write Z := Gntroneexp (Cinst)- 


o Completeness: Suppose Cingt encodes a satisfiable formula. Then there is a value-1 -register 
strategy for Y with no auxiliary register. 


o Soundness: If there is a -register strategy for Y with value at least 1 — €, then Cingt encodes 
a satisfiable formula. 


Furthermore, 
Q-length(¥) = O(1),  A-length(¥) = poly(2°**), 


Q-time(Y) = O(1),  A-time(Y) = poly(2*i**). 


Proof. The question lengths and question runtimes are both O(1) because all involved subtests 
have O(1) question complexity. The answer lengths and question runtimes are both poly(2**) 
because all our parameters are at most polynomial in n = 2%imst, and the question lengths and 
question runtimes of all involved subtests are polynomial in these parameters. 

We name the measurements used by the provers as follows. 


Points; : A, Pointsə : B, Points3 : C, Formula: F. 


We will write the identity matrix on registers 5 and 6 as Is5.¢ := Is ® Ig. 


Completeness. Suppose Cinst encodes a satisfiable formula. By Proposition 15.5, there are 
degree-d polynomials g : Fj’ > Fy and c1,..., Cm : Rm — F, such that if we define 


Pu bw, = i & TA & A & Tw & 15.6 E 1% = glui), Hj = cj(u, b, w)], 


then this strategy passes the formula test with probability 1. We extend this strategy to the 
remaining measurements as follows. 


Aunn = TE 8 h8 Begue Iso: [r = glu), 


Bun = 11 8 Ty Q B @ 48 Ise: 1v2 = g(u2)], 
Cig aes = lh ® h & Tee, & I, & 15.6 ‘ 1[v3 = g(u3)]. 


By the completeness of the introspective low-degree and intersecting lines tests, these can be ex- 
tended to a strategy which passes the whole test with probability 1. 


Soundness. Throughout this proof, we use ô(€) to represent functions of the form 


d(€) = poly(e,m-d/q*), 


where e > 0 is an absolute constant. 
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Low-degree tests. The strategy passes the introspective low-degree test with probability 1—6(e). 
Applying Theorem 13.10, there is a measurement G = {G4} in PolyMeas(m, d,q) such that 


(Auv Alice ® IBob Sifo) (Ta, @ D2 @ B 8 I4 @ 15,6 ® (Gigun )=r1])aux] Alice Q TBob- 


By Fact 4.32, we can assume this holds with equality with a loss of only 6(€) in the game value. In 
addition, by Theorem 4.1, we can assume that the G measurements are all projective. 

Next, the strategy passes the two introspective intersecting lines tests with probability 1 — ô(e€) 
each. By Theorem 14.6, this implies that 


(Buz,v2)Alice & IBob ~6(e) (h BT, ZO I3 & I, & Is, 6 & (Gigtas= va] Jaux) Alice & IBob, (68) 


(Cug,v3)Alice ® Ipob ~6(e) (i 8 h2 ® o? 8 I, 8 15,6 8 (Gigtus=ia) Jaux) Alice ® IBob- (69) 


Similarly, the strategy passes the introspective simultaneous low-degree test with probability 1— 
ô(e). Applying Theorem 13.12, there is a measurement J = {Jf , fo, f3,c1,...¢,,/ } in PolyMeas(m’, d, q, 3+ 
m’) such that 


(Fu,b,w,v,u)Alice & IBob 


Pis(e) (72 @ 1, @ 72, @ Thy B B56. ® (Jigen dunes (ub10) 14) aux) alice © TBob» (70) 


where the subscript of the J measurement ranges over all į € [3] and j € [m]. By Fact 4.32, we 
can assume Equations (68) to (70) holds with equality with a loss of only 6(e€) in the game value. 
In addition, by Theorem 4.1, we can assume that the J measurements are all projective. 


Consistency tests. The strategy passes the four consistency tests with probability 1— ô(€) each, 
implying 
( Faiva Alice & I Bob ~5(e ) Lalice & (Au, v1 Bob: 
(F, u2,v2 JAlice 8 IBob ~5(e ) Alice & (Buz,v2)Bob, 
( Fides Alice & IBob ~5(e6) ) Alice & (Cus,v3)Bob; 
CPi paises ali’ & IBob ~5(e) I alice & (Py papas Rebs 
By introspection (Fact 12.4), these imply the following statements: 


(Sif: (u,b,w)=11] Alice 8 IBob ~6(c) Latice @ (Gig(us)=v1])> 


(Fi fo(u,b,w)=v2] )Alice ® IBob ~5(c) Ialice ® (Gig(ug)=v9])> 
(Si f3(u,b,w)=v3] Alice © IBob ~6(c) TAtice @ (Gig(ug)=v3])> 
(Jic; (u,b,w)=p1;] ) Alice ® IBob ~65(e) Inlice © (Jic; ipa 


where the subscript of the J measurement ranges over all i € [3] and j € [m’]. Here, these 
statements are with respect to the strategy’s auxiliary state and to the uniform distribution on 
(u,b, w) € F7. 

Now we apply Fact 4.34. To do so, let us specify the sets G; and the distance parameter. The 
three sets G2, G3, and G4 will just contain all degree-d polynomials g : pr — F,. (Note that 
we can view the outputs of Gg as degree-d polynomials which disregard all of their input (u, b, w) 
aside from one of the three strings u1, u2, or us.) By Schwarz-Zippel, these have distance at 
least 1 — d/q. The remaining set, G1, is defined as follows: for each tuple of degree-d polynomials 
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C1,-++;€m/’, it contains a function c defined as c(u,b,w) = (ci(u,b,w),...,Em(u, 6, w)). Any two 

nonequal c,c’ € Gı have some coordinate i in which c; 4 c}, and on this coordinate alone they will 

have distance at least 1 — d/q by Schwarz-Zippel. Thus, c and c’ have distance at least 1 — d/q. 
Define the measurement {Kg,c1,...,c,,,} as 


Kg, 5.+-5C pp! = Gg i Jer, i Gy, 


Then Fact 4.34 implies that 
(Jif: (u,b 0) =v4,0;(u,b,t0)=p,] ) Alice & IBob ~5(e) I alice & (Kg(ui)=vi,c',(u,bw)=p5])> 


where the subscripts range over all i € [3] and j € [m’]. By introspection (Fact 12.4), this implies 
that 
(Fu,b,w, v, u)Alice & IBob 


~5(6) (7H, @ On @ Thy B 15,6 ® (Kg(us}=riey(ubx0) =n) aux) pice © [Bob (71) 


where the subscripts range over all į € [3] and j € [m’]. By Fact 4.32, we can assume Equation (71) 


holds with equality with a loss of only 6(e€) in the game value. 


Formula test: At this point, the formula prover’s strategy F satisfies the condition in Equation (67) 
with dı = d2 = d. In addition, it passes the introspective formula test with probability 


1 poly(e, m : d/q), (72) 
which by our setting of parameters is at least Z. Finally, our setting of parameters also implies that 


mee aeA tal (73) 


is less than 5: As a result, we can apply Lemma 15.6 to conclude that w is satisfiable. O 


Theorem 15.8 only proves soundness of the introspective NEEXP protocol against A-register 
strategies. Our last step is to compile this protocol into one which is sound against general strate- 
gies, while only slightly increasing the question length. 


Corollary 15.9. There is an absolute constant e > 0 such that the following is true. Let Cinst be a 
size-(Sinst) Succinct-Succinct-3Sat instance. Then there exists a game F := SintroNEEXP (Cinst) with 
the following properties. 


o Completeness: Suppose Cinst encodes a satisfiable formula. Then there is a value-1 real 
commuting EPR strategy for 2. 


o Soundness: If there is a strategy for F with value at least 1—e, then Cingt encodes a satisfiable 
formula. 


Furthermore, 
Q-length(Y) = O(sinst), A-length(Y) = poly(2°™*), 


Q-time(Y) = O(Sinst); A-time(Y) = poly(2""*), 
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Proof. Let n = PadN(Cinst) and s = PadS(Cingt). Set m = O(n/log(n)) and q = poly(n), as 
in Definition 15.7. Set A = (6,2,q), where 2 = (m,m,m,3 + s,3m + 3 + s,3m + 3 + s). Then 
GtntroNEEXP (Cinst) is a A-register game. Furthermore, by Definition 15.1, the register parameters are 
computable in time poly(sinst)- 

Let € > 0 be as in Theorem 15.8, and select a constant € > 0 and m,...,76 = 1/poly(n) 
such that d(e’) < e, where d(e’) = poly(é’,m,.-..,76) is as in Corollary 5.10. Now, if we apply 
Corollary 5.10, it gives us a game Y with the following properties. 


o IfC isa “Yes” instance, then @ptroneExP(Cinst) has a value-1 strategy with no auxiliary state, 
which implies that Y has a value-1 commuting EPR strategy. 


o IfC isa “No” instance, then every \-register strategy for @ntronEEXP(Cinst) has value less than 
1—e. By our choice of parameters, this is less than 1 — 6(e’), which implies that Y has no 
strategy with value 1 — e’. 


Furthermore, log(m) = O(log(n)) = O(sinst) and log(s) = O(log(n)) = O(sinst), giving us our 
desired question complexities, and poly(m) = poly(n) = poly(2*=st) and poly(s) = poly(n) = 
poly (2%™st), giving us our desired answer complexities. o 


Part V 
Answer reduction 


16 Testing error-correcting codes 


In Section 17 below, rather than the prover sending the verifier their entire “large” answer a, they 
will instead encode it into Enc(a) using an error correcting code and allow the verifier to query 
individual bits of the encoding. (The fact that the verifier is allowed to query bits of the encoding 
rather than the original string stems from the PCPP technology we use. See Section 17.3 for 
more details.) In this section, we develop the tests which verify that provers are performing this 
task honestly, so that when we query a subset of the bits J, they respond based on the bits of a 
codeword which was sampled independently of I. We will develop such a test for the low-degree 
code (Section 16.1). 

Our proofs are entirely standard: we start with the known property tester for this code (i.e. 
Theorem 4.40), which allows us to query the prover’s codeword at a uniformly random location. 
Then we use the local decodability properties of this code to allow us to query arbitrary subsets of 
coordinates. We begin by stating a slightly nonstandard definition of error-correcting codes relevant 
to our application. 


Definition 16.1 (Error-correcting codes). Let m and q be integers, and let 7 € [0,1]. An 
(n,m, q,1)-error-correcting code Code = (Enc, Dec, Sub) is defined as follows. 


o Sub is a subset of F” such that for each x Æ y € Sub, x and y have normalized Hamming 
agreement at most 77 (i.e. the probability, over a uniformly random 7 € [m], that x; = y; is at 
most n). 


o Enc: {0,1}" — Sub C F7 is the encoding map. 


o Dec : Fj’ > {0,1}" U {L} is the decoding map. For each x € {0,1}", Dec(Enc(x)) = x. In 
addition, for every w not in the range of Enc, Dec(w) = L. 
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Remark 16.2. The purpose of the subset Sub is this: in this section, we are designing games 
which test that a prover responds according to an error-correcting code. This means that the 
prover should respond based on the encoding Enc(x) of some string x € {0,1}". However, the 
games we design may only be able to test if the prover responds based on a string in Sub, which 
contains the encodings Enc(x) but may include other strings as well. This definition ensures that 
these other strings are still far from each other in Hamming distance. 


The next definition defines a subset tester. 


Definition 16.3. Let Code = (Enc, Dec, Sub) be an (n,m, q,7)-error-correcting code. Let k be an 
integer. Given a game ¥(-) whose inputs are from the set of subsets of [m] of size k and a probability 
distribution D over this set, we write Y(D) for the game in which we first sample I ~ D and then 
play 4 (I). Then ¥ is a k-subset tester with robustness 5(€) for Code if it satisfies the following two 
properties. 


o Completeness: Let (Y, M) be an EPR strategy in which {Mw} is a measurement with 
outcomes in {0,1}”. Consider the partial strategy (Y, G) in which 


I ca 
Gay,...ax = Mienc(w)|1=a1,...,06]° 


Then this can be extended to a (full) real commuting EPR strategy which, for each I, passes 
G(I) with probability 1. 


o Soundness: For any distribution D, consider a strategy (Y, M) which passes Y(D) with 
probability 1— e. Then there exists a measurement {Gw }w with outcomes w in Sub such that 


MŽ a 8 IBob 5c) TAlice D Gfw|p-=a1,...,0%]* 


16.1 Testing the low-degree code 


In this section, we show how to test the low-degree code. This is essentially an exercise in general- 
izing Theorem 4.40 to arbitrary subsets. We begin with some notation. 


Notation 16.4. We write F7, for the family Fop = {F C Fj’ | |F| < k} 


Now we define the low-degree code tester. 


Definition 16.5. Let m, q, and d be integers. Let k be an integer, and let F' be an element of Fyk- 
Then @ psubset(™, q, d, F) is the game defined in Figure 13. 


The performance of the low-degree subset game is given by the following theorem. 


Theorem 16.6. Consider low-degree parameters params = (n,q,h,H,m,S,7). Set d= m(h — 1). 
Set m! = q™. We will identify strings in Fm with functions g : F? > Fy. Given a € {0,1}", 
define Enc(a) = ga and Dec(ga) = a. For all other g : Fj’ — Fy (i.e. those which are not the 
low-degree encoding of a string a), define Dec(g) = L. Finally, define Sub to be the set of degree d 
polynomials g : Fj’ —> Fy. Then Code = (Enc, Dec, Sub) is an (n, m’, q,d/q)-error-correcting code. 

Furthermore, there exists a constant c > 0 and a function 6(€) = poly(e,dm/q°) such that the 
following holds. Let k be an integer. Then @psubset >= ADsubset(™, q, d,-) is a k-subset tester for 
LDCode with robustness d(e). 

Finally, 


Qtime(Apsubset) = poly(m,k, log gq), A-time(Apsubset) = poly (m, d*, log q), 
Q-length(G@psubset) = O(kmlogq), A-length(@psubset) = O(d* log(q)). 
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With probability 2 each, perform one of the following two tests. 


1. Low-degree: Perform %urface(m, d, q, 2). 


2. Cross-check: Flip an unbiased coin b ~ {0,1}. Let s be a uniformly random subspace of 
dimension k + 1 containing the points in F. With probability 3 each: 


(a) Let w be a uniformly random point in s. Distribute the questions as follows: 


o Player b: give w; receive a value y € Fy. 


o Player b: give s; receive a degree-d polynomial g : s > 


Accept if g(w) = y. 
(b) Distribute the questions as follows: 
o Player b: give s; receive a degree-d polynomial g : s + F4. 
o Player b: give F; receive a function f : F —> Fy. 


Accept if glr = f. 


Figure 13: The game @ Dsubset (M, q, d, F). 


Before proving this, we need the following proposition. 


Proposition 16.7. Let F C Fy be of size at most k. Consider the distribution Dtwostep on 
points x € Fj" generated by the following two-step process: (i) let s be a uniformly random subspace 
of sizek +1 containing F, and (ii) draw x uniformly at random from s. Let Dunit be the uniform 
distribution on Fj’. Then drv (Dtwostep, Dunit) < 1/4. 


Proof. Let x1,...,2¢ be a maximal set of linearly independent elements from F. A uniformly ran- 
dom subspace of size k+ 1 containing F can be generated as follows: first, pick a uniformly random 
nonzero vector Yı linearly independent from F, then pick a uniformly random nonzero vector 
Ye+ linearly independent from F U {y¢41}, and so forth. Set s = span{z1,..., 2e, yes1,---,YRyi}- 
A uniformly random point in s will be of the form 


x = tizi +++ + teze + bei yey Ho + bese 


where each t; is a uniformly random element in Fy. Because all the y;’s are linearly independent, the 
linear combination te+1Ye41 +--+: + tk+1Yk+1 is zero only when ty; =--- = p41 = 0. Otherwise, 
this linear combination is distributed as a uniformly random nonzero vector linearly independent 
from F. Thus, with probability (q*t!~)—1, æ is distributed as a uniformly random vector in the 
span of F, and otherwise it is distributed as a uniformly random vector outside the span of F. 
Given that the span of F has qf points, the total variation distance is 


Lig@—¢ 1 ay 1 1 1 
a) - |1- = eg | eS ]) <L. o 
+5 | gm g T\ Ge gm] 4 


Now we prove Theorem 16.6. 


qf 1 
q” E gkt1—€ 


1 
2 


Proof of Theorem 16.6. The fact that Code is an (n,m’,q,d/q)-error-correcting code follows from 
Schwartz-Zippel (Lemma 3.6). 
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Completeness. Let (Y, M) be an EPR strategy in which {Mw } is a measurement with outcomes 
in {0,1}”. Consider the strategy (Y, GŒ) in which for any subset of points F = {y1,..., ye}, 


I — 
Gar, ae = Mga (yt) yauosge(¥2)=01 y--n04]* 


(This covers the case of points (¢ = 1) and subsets F (€=k).) In addition, for any subspace s, 
Gy = Migaļs=f]: 

(This covers the case of the 2-dimensional subspaces used in point and the (k + 1)-dimensional 
subspaces used for the local decoding.) By construction, (Y, G) is an EPR strategy, and it is easy 
to see that it is a commuting one as well. 

We claim that (p, G) passes A@psubset(m, g,d,D) with probability 1. We begin with the low- 
degree test. By Fact 4.37, My 8 IBob ~0 LAlice 9 My. Then by Fact 4.26, 

Migz(w)=b] 8 IBob Xo Latice 9 Mig, (w)=0]- 
This implies passing the low-degree test with probability 1, because 
Gi p(w) =o] ® [Bob = Mga (w)=0] ® IBob o Inice ® Miga (w)=b] = Inlice ® Gy. 


A similar argument shows the other tests pass with probability 1 as well. 


Soundness. Let D bea distribution, and let (Y, M) be a strategy which passes @Dsubset (M, q, d, D) 
with probability 1 — e. The outline of the proof is as follows: first we will use the low degree test in 
Item 1 to ensure the test correctly answers low-degree point queries. Item 2a will then bootstrap 
this to subspaces, and Item 2b will further bootstrap this to subsets, proving the theorem. 


Using the low-degree test. Passing the test with probability 1 — € means passing the low- 
degree test with probability at least 1 — 2e. By Theorem 4.40, this means that there exists a 
POVM measurement G € PolyMeas(m, d, q) such that 

My” 8 Bob ~6(c) Talice @ Gig(w)=o}, Cg 8 Bob ~5(c) TAlice @ Gg, (74) 


where the first is on the uniform distribution over Iye 


Bootstrapping to subspaces. Define Dtwostep to be the two-step sampling process (F, s, w) as 
in Item 2a. By Proposition 16.7, the marginal distribution on w has total variation distance at 
most 1/q with Dunif. As a result, we can apply Fact 4.21 to Equation (74), yielding 
Mp” & IBob ~5(c) alice @ Gg(w) =o) (75) 
on distribution Dtwostep- Similarly, by Fact 4.26, 
Gig(w)=] © IBob ~6(c) Alice @ Gig(w) =] (76) 
on distribution Dtwostep- 


Next, because the strategy passes the test in Item 2a with probability at least 1 — 4e, 


My ® IBob ~e Ialice 9 Mic (77) 


w)=y)" 
on distribution Dtwostep. Combining Equations (75) to (77) with our second triangle inequality 
(Fact 4.29), 

Mig(w)=y] ® TBob ~5(c) Talice @ Gig(w)=0): 
By Proposition 4.42, we conclude that 


M? ® Ibob ~5(c) Zalice 8 Gig|,=F)- (78) 
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Concluding with subsets. The strategy passes the test in Item 2b with probability at least 
1—4e. As a result, 
MF ® IBob ~e Talice @ Mj ,.= 4): 


Applying Fact 4.26 to Equation (78), 
Mig\n=f] ® TBob ~5(c) Lalice ® Gh] p=nh)- 
Similarly, applying Fact 4.26 to Equation (74), 
Gin|r=s] © {Bob ~a(c) Latice D Ginjr=z) 
Applying the triangle inequality (Fact 4.29) to these three equations, we get 
MF ® IBob se) Latice ® Gigi p=f] 


with respect to distribution Diwostep, and therefore, by Fact 4.23, with respect to D. Oo 


16.2 Efficiently decodable codes 


Our application requires error-correcting codes with two further properties. The first property is 
that the decoding map Dec(-) be efficiently computable. (The encoding map, on the other hand, 
is allowed arbitrary complexity. This is because we will leave the task of computing the encoding 
maps to the provers.) The second, more technical property is we require that the code embed the 
codeword, in the following sense: the encoding Enc(x) of a string x should actually contain the 
string x, and the function for where to find each bit of x in Enc(x) should be efficiently computable. 


Definition 16.8 (Efficiently-decodable error-correcting codes). Let m,q : Zt — Zt, and let 
n: Zt — [0,1]. Let tpec, temp : Zt —> Zt. We say that Coden = (Ency, Decn, Subn) is an 
(n,m, 9,1, tDec, temb)-efficient code family if the following three conditions are true. 


o For each n, (Encn, Decn, Subn) is an (n, m(n), g(r), n(m))-error-correcting code. 


o There exists an algorithm Algp,, which, on input (n,w), outputs Dec,(w). Furthermore, 
Algpec runs in time tpec(n). 


o There exists an embedding 4n : [n] > [m(n)] such that for each ż € [n], x; = (Encn(£)) an 
Furthermore, there is an algorithm Alggmp which, on input (n,i), computes un(i) in time 


temb(7n). 


Now, we show that the low-degree code is efficiently-decodable. The decoding algorithm follows 
a simple strategy: assuming that the input is a proper encoding of a message, they can directly 
read off the message from the input. Then they compute the encoding of the purported message 
and check that it equals the input. 


Fact 16.9. There is a (n, m',q, N, tDec, temp)-error-correcting code Code with parameters set as 


follows: 
1 


~ polylog(n)’ 
tDec(m) = poly (n), temb(n) = polylog(n). 
In addition, Code has a k-subset test Y with robustness 6(€) = poly(e,1/log(n)) such that 
Q-time(Y) = poly(logn,k), A-time(Y) = poly(log(n)*), 
Q-length(Y) = O(klogn), A-length(Y) = O(log(n)?*). 


m'(n) = poly(n), q(n) = polylog(n), n(n) 
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Proof. We instantiate the canonical low-degree encoding from Definition 3.8 with the “rule of 
thumb” parameters from Equation (1): 


h(n) = Əlog)), mln) = (EP) g(n) = potytou(n). 
If we set d(n) = m(n) - (h(n) — 1), then this is a code with distance n(n) = 1 — d(n)/q(n) = 
1 — 1/polylog(n). In addition, it has length m!(n) = q(n)™” = poly(n). Finally, the canonical 
low-degree encoding gives us the embedding HEmb := Om,ty,t2. By Proposition 3.9, it takes time 
temb(n) = polylog(n) to compute. 

Now we design the decoding algorithm Algp,,. On input (n, w), it rejects if w is not length m’. 
Otherwise, it interprets w as a function f : Fj’ > Fy. It queries g on the points 7(1),...,7(n). Let 
a € {0,1}”" be the received answers. If g is a codeword, it equals the low-degree function ga. So 
the algorithm simply iterates over all x € Fj’ and checks that f(x) = ga(x). By Proposition 3.9, 
computing ga(x) can be done in time poly(n), and so this takes time tpec(n) = poly(n) in total. 

Finally, the performance of the subset tester follows from Theorem 16.6 with our setting of 
parameters. O 


17 Answer reduction 


In this section, we carry out the answer reduction. Our main result will be to take the poly(n) 
question complexity, O(2”) answer complexity MIP* protocol for Succinct-Succinct-3Sat given by 
Corollary 15.9 and convert it to one whose answer complexity is also poly(n); this is Theorem 17.12 
below. 

Our answer reduction will apply to any game with a value-1 real commuting EPR strategy. We 
will require two properties of these strategies: first, that they can be extended to strategies that pass 
subset tests with probability 1, as in Definition 16.3; and second, that they are “oracularizable”. 
We explain this second property in the next section. 


17.1 Oracularization 


Our technique will not work for all entangled games but only for a subset, for which a single prover 
can simulate both prover’s actions if required to. We call such games “oracularizable” games. 


Definition 17.1. Given a two-player entangled game Y, its oracularization is the game Coracle(Y) 
given in Figure 14. If Z is value-1, then we call it oracularizable, if val(Coracte(Y)) = 1 as well. We 
also note that for any game Y, if val(Y) < 1— ô, then val(Coracte(Y)) < 1 — O(6). 


A real commuting EPR strategy allows “Player b” to sample both questions xg and 21 simultane- 
ously. As a result, if a game Y has a value-1 real commuting EPR strategy, then it is oracularizable. 

The value of oracularization is that when the verifier checks V (£o, £1,a0,a1) = 1, both ao 
and a; come from the same prover rather than two different provers. This seems like a minor 
change, but in fact it makes all the difference. Our goal is to reduce the verifier’s runtime by 
having the provers encode their answers using PCP technology. When the answers come from both 
provers, the relevant piece of PCP technology is a distributed PCP, but it is known by a simple 
argument of Reingold that distributed PCPs do not exist (see the discussion in [ARW17]). The key 
difficulty comes from the fact that Alice needs to prepare her PCP proof without knowing Bob’s 
question and answer, and vice versa, and this turns out to be impossible in general. On the other 
hand, when the answers come from a single prover, we can use traditional PCPs to implement the 
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Given a game ¥Y, sample a tuple (£o, x1, C) ~ Y, and flip two unbiased coins b,c ~ {0,1}. With 
probability 5 each, perform one of the following two tests. 


1. Verify: Distribute the questions as follows: 


o Player b: send the pair (ao, xı) and receive answers (ao, a1). 


o Player b: send £e and receive an answer a2. 


2. Consistency: Play the consistency game with question £o, £1. 


Accept if ag = a, and V (zo, £1, a9, @,) = 1. 
Figure 14: The oracularized game Coracie(Y). 


answer reduction, of which we have a variety of constructions. We note that oracularized games 
do still have checks between players, but these are equality checks and will be easy to implement 
in the answer reduction regime. 


17.2 Probabilistically checkable proofs of proximity 


In this section, we introduce the main PCP technology we will use for our answer reduction. In the 
oracularized game, the provers want to convince us not just that V(-,-,-,-) is satisfiable—which we 
already know to be true by construction—but that (£0, £1, a0, a1) is a particular assignment which 
satisfies it. For this, we need a stronger notion of a PCP called a probabilistically checkable proof of 
proximity (PCPP). These allow one to check that an input z is close to a satisfying assignment of a 
circuit C (hence the “proximity” ) by making a small number of queries to x. These were originally 
introduced in the independent works of [BSGH*06] and [DR06] (where they were called assignment 
testers). 

In our case, we will need even stronger PCPPs in which the verifier is not only query-efficient but 
time-efficient as well. The history of these time-efficient PCPPs goes back to the original proof of 
MIP = NEXP and the various attempts to “scale it down” [O’D05]. The most famous line of research 
considered proof systems in which the verifier’s query complexity is restricted, and this eventually 
led to the proof of the PCP theorem [AS98, ALM7*98]. A parallel line of research considered proof 
systems in which the verifier’s runtime is restricted (so-called “transparent” proofs) [BFLS91]. The 
latter of these was revisited in the work of Ben-Sasson et al. [BSGH*T05], who showed that both 
lines of research could be remerged in the “scaled down” setting by constructing a PCPP in which 
the verifier is both query-efficient and time-efficient. Though their main result is actually sufficient 
for our purposes, we will cite the work of Mie [Mie09], which improves on their result in the regime 
we care about. Finally, we note the work of Meir [Meil4], who reproves the bounds of Ben-Sasson 
et al. [BSGH*05] using combinatorial methods. 

To our knowledge, ours is the first use of a time-efficient PCPP specifically for its time-efficient 
properties in the quantum literature. Natarajan and Vidick [NV 18a] used the time-efficient PCPP 
of [BSGH*05] to prove the quantum games PCP conjecture, but the property they needed was 
not that it was time-efficient, but that the bits of the proof are linear functions of the bits of the 
assignment. We note that we do not need this property here. 

In this literature, it is common to consider “pair languages” consisting of strings (x, y) in which æ 
is small and given to the verifier and y is large and accessible only through query access. This maps 
perfectly onto our scenario, in which the verifier supplies the “small” questions a,x, and the 
prover supplies the “large” answers ao, a1. 
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Definition 17.2. A pair language L is a subset of {0,1}* x {0,1}*. Given x € {0,1}*, we write 
Ly = {y E {0,1}* | (x,y) € L}. 


The next two definitions state the notion of an efficient PCPP verifier. 


Definition 17.3 ((BSGH+05, Definition 2.1]). Let r,q : Zt > Zt and t : Zt x Zt +4 Z+. An 
(r,q, t)-restricted PCPP verifier is a probabilistic machine that, given a string x (called the explicit 
input) and a number K (in binary) as well as oracle access to an implicit input y € {0,1}* and to 
a proof oracle mt € {0,1}*, tosses r(|z|-+ K) coins, queries the oracles (y, 7) for a total of q(|x| + K) 
symbols, runs in time t(|x|, K), and outputs a Boolean verdict in {accept, reject}. 


Definition 17.4 ([BSGH™05, Definition 2.2]). For functions r,q : Z* > Zt, t:Z* x Zt > Z*, 
and constants s,y € [0,1], a pair language L C {0,1}* x {0,1}* is in PCPP, „[r,q,t] if there exists 
an (r,q,t)-restricted PCPP verifier V with the following properties: 


o Completeness: If (x,y) € L then there exists a m such that Pre[V"7 (x, |y|; R) accepts] = 1, 
where V¥"(x,|y|; R) denotes the decision V on input (x, |y|), oracle access to (y, 7), and coin 
tosses R. 


o Soundness: If (x,y) is such that y is y-far from Lẹ N I¥!, then for every m it holds that 
PrpRr|V”" (x, |y|; R) accepts] < s. 


Mie’s time-efficient PCPP is states as follows. 


Theorem 17.5 ([Mie09, Theorem 1]). Suppose that L is a pair language in NTIME(T) for some 
non-decreasing function T : Zt — Z*. Then, for every two constants s, y > 0, we have L € 
PCPP, „[r,q, t], for 


o Randomness complexity r(m) = logy T(m) + O(log log T(m)). 
o Query complexity q(m) = O(1), 
o Verification time t(n, K) = poly(n, log K,log T(n + K)). 


We note that this is in fact a much stronger than what we will actually need. In particular, we 
will only apply this to languages L in deterministic TIME(T), which are trivially in NTIME(T). 


17.3 Composing with an error-correcting code 


The verifier in a PCPP rejects any input which is y-far from an accepting input, but of course we 
want our verifier to reject all non-accepting inputs, no matter their distance. To do this, we will 
(i) encode the verifier’s inputs using an error-correcting code and (ii) check that the inputs are 
properly encoded (using, for example, the low-degree test). This approach of composing a PCPP 
with an error-correcting code is standard and stretches back in spirit to the transparent proofs 
of [BFLS91] (see the discussion of this in [BSGH*06]). 

Now we show how to compose an MIP* game with an error-correcting code. 


Definition 17.6 (Error-correcting the provers’ answers). Let V = (Algo, Alga) be an MIP* verifier 
(the language it verifies is not important). Suppose on inputs of size n it has question length a(n) 
answer length £a(n). Write La for the language decided by Alga. Let Code, = (Encg, Deck, Sub;) 
be a (k, M, q, N, tDec, temb)-efficient code family with decoding algorithm Algp,.. Then La o Code is 
a new language defined as follows: suppose (input, £o, £1, yo, y1) E La. Let n be the length of input 
and ¢ = £a (n). Then (input, zo, x1, Ence(yo), Ence(yi)) € La o Code. 
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Now, we prove a couple of properties about the composed verifier. First, we show that its 
runtime is not much slower than the original verifier’s. 


Proposition 17.7 (Runtime of the composed verifier). Let V and Code; be as in Definition 17.6. 
Suppose Alga runs in time T(n). Then there is an algorithm, which we denote Alg, o Code, 
deciding the language La o Code. In addition, on inputs (input, £o, £1, 20, 21) in which |input| = n, 
|xo| = |x1| = £a(n), and |zo| = |z1| = m(éa(n)), the algorithm runs in time T(n) + tdec(la(n)). 


Proof. On input (input, £o, £1, 20, 21), we define the action of Alg, o Code as follows. 
1. Compute n, the length of input. Set @:= 44 (n). 
2. Check that zo and zı have length m(£). If they don’t, reject. 
3. Compute yo = Algp.c (4, zo) and yı = Algp,. (4, 21). If either yo or yı is L, reject. 


4. Otherwise, we know that yo, y, € {0,1}£. Run Alga (input, £o, 71, yo, y1). Accept if it accepts, 
and reject if it rejects. 


It is immediate that Alg, o Code computes La o Code. As for the time complexity, Item 3 runs 
in time tpec(€a(n)) and Item 4 runs in time T(n). Combined, these two give the bound in the 
proposition statement. oO 


Next, we show that this construction solves the “problem” discussed at the beginning of the 
section, namely that if we perform answer reduction by replacing Alg, o Code with a PCPP verifier, 
rather than just Alg,, then the verifier will reject all inputs which are not in the language, not 
just those which are 6-far, provided that those inputs are encoded as per Definition 17.6. 


Proposition 17.8. Let V and Code, be as in Definition 17.6. Let s,y > 0 be constants, and let 
Vecpp be the PCPP verifier for the language La o Code guaranteed by Theorem 17.5 with these 
parameters. Suppose that 1—n(k) > 2y for allk. Then we have the following soundness condition. 


o Soundness: Consider (input, xo, £1, 20, 21) for input of length n, xo and xı of length la(n), 
and 29,21 E Subp, for £ := a(n). Suppose this does not correspond to the encoding of an 
accepting assignment in La. In other words, suppose that there are no yo, yi € {0, 1¥ such 
that (input, zo, £1, Y0, Y1) is in La and z = Ence(yo), 21 = Encg(yi). Then Vpcpp accepts 
(input, £o, £1, 20, 21) with probability at most s. In math, for every n it holds that 


Pr[Vpcpp’ (input, zo, 21, |zol + |z1|;.R) accepts] < s. 


Proof. Given (input, 29,21, 20,21), write A := (La o Code)input,2,2, N ela By assumption, 


(z0, 21) is not in A. Using this, we would like to show that (zo, 21) is in fact y-far from A, in which 
case the PCPP verifier accepts with probability at most s. 

To do this, suppose (z), z1) € A. By design, there exists yg, y| € {0,1} such that 24 = Enc(y)) 
and z; = Enc(yj). This means that 26, z, € Sube. On the other hand, since (zo, z1) is not in A, we 
must have either 2g Æ zo or zį Æ zı (or both). We will assume the first without loss of generality. 
Then by the distance property of the code, since zo, 24 E€ Subg, their normalized Hamming distance 
is at least 1— n(£) > 2y. This immediately means that (zo, z1) and (zg, z1). are at least 7-far apart, 
and we are done. oO 
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17.4 The answer reduction protocol 


We are almost ready to state the answer reduction protocol. Before doing so, we discuss one final 
nuisance, which is that we will also need the prover to encode their proof with an error-correcting 
code. The reason is that we would like to query the proof on a view J sampled by the PCPP 
verifier. However, the prover might cheat and respond based only on the view J rather than a 
global proof m. To prevent this, we force them to commit to a global error-correcting encoding of 
their proof 7 using a tester as in Definition 16.3. Then, we use the fact that the error-correcting 
code embeds their string to allow us to extract the view J by asking for the coordinates in (J). 
We now state the answer reduction protocol. 


Definition 17.9. We instantiate the answer-reduced MIP* protocol with the following algorithms 
and parameters. 


o Let V = (Algg, Alga) be an MIP* verifier for a language L. Write La for the language 
decided by Alg,. Suppose on inputs of size n, the verifier V has question length fy.q(n), 
answer length Zya (n), question time ty,q(n), and answer time ty, a(n). 


o Let Code, = (Encg, Dec, Subg) be a (k, m, q, N, tDec, temp )-efficient code family with decoding 
algorithm Algp,, and embedding juz. 


o Let G be a game which tests for Code, with robustness y;z(€). Suppose it has question 
length fg q(k), answer length fy a(k), question time ty g(k), and answer time tg a(k). 


o Let s,ô > 0 be constants, and let Vpcpp be the PCPP verifier for the language La o Code 
guaranteed by Theorem 17.5 with these parameters. Suppose on inputs of size n it has proof 
length £,(n). By Proposition 17.7, La o Code is in time tcompose(™) = tv,a(n) + toec(£v,a(n)). 
We can therefore write Vpcpp’s verification time as 


tpcpp(n) = poly(n + £v,o(n), log(m(£v,a (n))), log tcompose(™))). 


Finally, ¢, (n) = tcompose(n) i polylog(tcompose (n)). 
Write 41 := lya (n) and l2 := ¢,(n). Then the answer reduction game Ganswer (input; V, Code, Y, s, ô) 


is given in Figure 15. We write Vanswer for the corresponding verifier. 


Theorem 17.10. Suppose V, Code, $, and Vpcpp are as in Definition 17.9. Suppose s,y are cho- 
sen to be constants such that n(k) > 2y for allk. Suppose further that V has the following property: 
for any input in L, the provers have a real commuting EPR strategy with value 1. Then Vanswer 15 
also an MIP* verifier for L with the following two conditions: 


o (Completeness) If input € L, then there is a value-1 strategy. 


o (Soundness) Given input, suppose there is a strategy with value 1—e. Then there is a strategy 
for V on input input with value 1 — d(e), where d(€) is given by 


(€) := poly (xe (poly(€)), Xe (poly (€)), 7(41), n(42)). 


Hence, if we choose our parameters so that 1— (€) is greater than the soundness of V, this implies 
that Vanswer is an MIP* verifier for L with soundness 1 — e. 


112 


Flip two unbiased coins b,c ~ {0,1}. Sample questions (xo, %1) ~ Algg(input). Sample a view 
Io, I1, J ~ Vpecpp(input, æo, x1). Set J’ = pe,(J). Select io i1 E€ [m(4)] and j € [m/(é,(n))] 
uniformly at random. Set To = Io U {io}, Ti = I U {i1}, and U = J’U {7}. With probability i 
each, perform one of the following eight tests. 


1. Verify: Distribute the question as follows: 
o Player b: give (xo, xı), To, T1, U; receive ag, aj, a2. 
Accept if Vpcpp (instance, £o, #1) accepts on ao|z,,@1|r,, @2| y’. 
2. Cross checks: 


(a) Consistency test: Distribute the questions as follows: 


o Player b: give (xo, x1), To, T1, U; receive ao, a1, a2. 


o Player b: give (xo, £1), To, T1, U; receive ah, al, ah. 


Accept if ag = ap, aı = a4, and az = ab. 
(b) Answer cross-check: Distribute the questions as follows: 
o Player b: give (xo, x1), To, T1, U; receive ao, a1, a2. 
o Player b: give £e, T’; receive a’. 
Accept if ac = al.. 
(c) Proof cross-check: Distribute the questions as follows: 
o Player b: give (xo, xı), To, T1, U; receive ag, aj, a2. 
o Player b: give £o, æ1, U; receive as. 


Accept if ag = ab. 
3. Code checks: 


(a) Answer code check: Sample questions (wo, wi) ~ 2a (Te). Distribute the questions 
as follows: 


o Player b: give £e, wo; receive ao. 
o Player b: give £e, w1; receive ay. 
Accept if %,(T'-) accepts on ao, a1. 


(b) Proof code check: Sample questions (wo, w1) ~ %,(U). Distribute the questions as 
follows: 


o Player b: give £o, £1, Wo; receive ag. 
o Player b: give ao, #1, w1; receive ay. 


Accept if %,(U) accepts on ao, a1. 


Figure 15: The answer reduction game answer (input; V, Code, GY, s, ô). 
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Furthermore, the question and answer lengths and runtimes are dominated by two subroutines: 
the “Verify” subroutine Sı and the “Code Check” subroutine Sz (consisting of both the answer code 
check and the proof code check). The complexity of the Verify subroutine is 


Q-length(S1) = O(fy,q(n) + log(m(ly,a(n))) + log(m(é,(n)))), 
A-length(S1) = O(log(q(¢v,a(n))) + log(q(éx()))), 
Q-time(S1) = O (ty,q(n) + tecpp(n) + temp(n(7))) » 
A-time(S;) = O(tpcpp(n)). 


In addition, the complexity of the Code Check subroutine is 


Q-length(S2) = O (lg o llv, a (n)) + l9,Q(n(n)) + &v,Q(n)), 
A-length(S2) = O (lg a (lva (n)) + £g a (lr(n))), 
Q-time(S2) = O(ty,q(lv,a(n)) + tg,qllr(m)) + tvo (n) + temb(tr(n))), 
A-time(S2) = O(tg,a(év,a(n)) + tg a (l:(n))) 


Thus, the complexity of the overall protocol is the sum of these two. 


Proof. The fact that Sı and Sy dominate the lengths and runtimes of the protocol is because 5} 
dominates the lengths and runtimes of the two cross-check subroutines, whose questions and answers 
are subsets of those in S1. Now we compute the complexity of S1. 


o Question length: The pair (ao, x1) has total length ¢y.q(n) by definition. The pair Io, Tı 
are subsets of indices of constant size into each of the implicit inputs of La o Code, which are 
supposed to be encodings of strings of size ly, a (n). Hence, the encodings have size m(ly a (n)), 
and so each input is specified with the log of this many bits. Finally, J is a constant-sized 
set of indices into a proof of size £,(n), and (J) converts these into indices into an encoding 
of of this proof. As the encoding has length m(é,;(n)), each index can be specified with the 
log of this many bits. 


o Answer length: The strings ao, a, contains values from an error-correcting code with alpha- 
bet ¢(¢v,a(n)), and the string az contains values from an error-correcting code with alphabet 


qln(n)).- 


o Question time: The running time of Algo is ty.q (n). The running time of Vpcpp is tpcpp(n). 
Finally, the running time to compute u(J) given J is temp(é7(n)). 


o Answer time: The running time is simply the running time of Vpcpp, i.e. tpcpp(n). 


As for the complexity of S2, it just performs the code tester G, for message lengths k = £y a(n) 
and ¢,(n) and so inherits the lengths and runtimes of the tester for these two values of k, except 
on top of that it also has to sample (ao, #1) and compute J’. Sampling (ao, 71) takes time ty.q(n) 
and contributes O(fy.q(n)) to the question lengths, and computing J’ takes time temp(¢x(n)). 


Completeness. Suppose input is in L. Then there is a real commuting EPR strategy (Y, M) 
with value 1 for V on input. We will use this to demonstrate a value-1 strategy for Vanswer. This 
will be the strategy (p, G) which uses the same EPR state |w) and has measurement matrices G 
defined as follows. 

Fix questions 29,21, To, Tı, and U. We begin by defining the simplest measurement, 


Gee = (79) 


Le 
[Ence] (ze)|Te=ac]" 


114 


If Alice and Bob measure with M*° and M”: and receive strings zo, 21, then because this strategy 
is value 1, we will always have V (input, 20,21, 20, 21) = 1. As a result, there always exists some 
proof for Vpcpp that (input, xo, 271, Ence (zo), Ence,(z1)) is in La o Code. We denote this proof 
™(X0,X1, 20,21); if there are multiple such proofs, we pick one arbitrarily. Then we define the 
measurement 

Cat = (M* ` M™ ) ences (m(a0 1,20,21)) |v =a2 * (80) 


Next, we define the measurement 


x0 ,t1,;T9,11,U ._ To, T1 
Gasiarag | = (MP - M”) Ence (20)|-29 Ence, (21)lr Ence, (2 (£0,21,20,21))lu=a0,a1,a2]' 


Now, via Equations (79) and (80), the G measurement is exactly of the form required by Definition 16.3. 
As a result, it can be extended to a measurement which passes the answer and proof code checks 
with probability 1. Performing this extension concludes the design of the strategy. 

By construction, this strategy passes the answer and proof code checks with probability 1. As 
for the remaining tests, let us begin with the answer cross-check in the case of c = 0, the other 
case being symmetric. Because M is a real commuting EPR strategy, by Fact 4.37 we have that 
Mz ®IBob Xo Inlice® ME for any distribution on z. If we consider the measurement (M*°-M*!),, 2, 
then (M*°. M™1),, = Mz°. As a result, 


(M*° - M™)z ® IBob “0 IAlice @ Mz). 
Finally, by data processing (Fact 4.26), this implies that 


(M*° . M” )ience, (20) |T =20] 8 IBob ~0 Lalice ® M Encs, (2) |7 =a0]" 

But this is equivalent to saying that Go? TTT 9 TBob ~o Inlice Q Gao ae which implies passing 
the cross-check test with probability 1. A similar argument holds for the other tests, with the 
exception of the verification step. 

Consider the measurement M3? - M3}. By construction and the properties of the PCPP verifier, 
if this measurement always outputs 20, z1 such that V (input, £o, £1, 20, 21) = 1, then the G strategy 
always passes the verify step. But because M is a real commuting EPR strategy, M? © Ipob ~o 
Inice © M7, which implies that 


MX O Mz} So Mz? - Mz} ® Ibob. 


Thus, these two measurements have the same output distribution. But the left-hand side always 
outputs zo, 21 which satisfy the verifier, because this strategy passes the verifier with probability 1. 
This concludes the completeness step. 


Soundness. Suppose input is not in L. Let (y, M) be a strategy that passes with probability 
l-e. 


Code checks. Passing the overall test with probability 1— e means the strategy passes the answer 
code check with probability 1 — 8e. Given values c, £e, write 1 — €c, for the probability the code 
check passes conditioned on these values. Then with probability at least 1 — 8¢!/?, Cote Í a 
When this occurs, Theorem 16.6 implies that there exists a measurement {G7c},, with outcomes 
in Suba, such that 

MZT: & Ibob sfe) Ialice 8 GPE 


[wlr =a] 
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with respect to the distribution of Te conditioned on c and ze. When this does not occur, we still 
can assume such a measurement so that 


Mere & Ipop 1 Taice © GP 


[w|r, =a] 


trivially, by Fact 4.19. Thus, if we average over c and £e, 


Me"? ® Ibob %s(c) Talice ® Ge (81) 


[w|n.=a] 


with respect to the distribution on c, £e, Te. A similar argument with respect to the consistency 
guarantee of Theorem 16.6 implies that 


Gae ® IBob ~6(e) INice ® Gir. (82) 
By Fact 4.26, this implies that 


Gre 


[w|7.=a] 


& IBob > Ialice & Gi ips] 
As a result, if we apply Fact 4.13 to this and Equation (81) and then use the triangle inequality 
(Fact 4.28), we conclude 

Mier" & Ipob Ssl) GE aj © Bob (83) 


[wlr.= 

with respect to the distribution on c, £e, Le. 

Applying a similar argument yet again, this time to the proof code check, implies that for every 
£o, 21, there exists a measurement {H7,""'},, with outcomes in Suby, such that 

3 ,U ~~ ? 
Myo" @ Ibob Sale) Arif; <a) © Bob (84) 

with respect to the distribution on £o, x1, U. Thus, by Fact 4.32, we can assume that Equations (83) 
and (84) hold with equality with a loss of only 6(e€) in the game value. In addition, by Theorem 4.1, 
we can assume that the G and H measurements are all projective, possibly replacing ~ with a 
different state. 


Cross checks. Our next step is to apply the cross-checks. Passing these with probability 1 — â(€) 
implies the bounds 


#0,01,10,11,U Pe f zo, To _ , i 
Mao mee" @ Bob (e) Inlice ® Mao ° = Iatice ® Chala =a0)? (85) 
£0,01,10,11,U ey f aT _ l Hi 
May mee © TBob —d(€) Iplice ® May * = Iptice 8 Chwlr, =a) (86) 
LO, Ti T ,U AS . L0, „U — . £0,£1 
Maz nro” & TBob ~6(e) Ialice © Mar 1” = Iplice ® Diya)? 
, Ti T U ~~ , ‘Ti T ,U 
Moara” | © TBob ~a(e) Taice 9 Map anan” Y + (87) 


At this point, we would like to apply Fact 4.35. To do so, we have to verify the distance property 
of our functions, and this will follow from the fact that we augmented our index sets Ip, T4, and J’ 
with an additional uniformly random index. To see this, consider two nonequal w and w’ in Suby,. 
Then for them to agree on To, they must agree on ip, and this happens only 7(¢,) fraction of the 
time. The same holds for U, with the bound of n(¢2). As a result, Fact 4.35 implies the following: 
consider the POVM measurement {Au w1, } with outcomes wo, w1 in Subp, and r in Subs, defined 
as 

Ne = Gin He a Gia: (88) 


WO ,W1,7 
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Then 
Me TY © Tey Siig Tae OA. (89) 


ag a1 ,a2 [wo|r wilr 7|v=40,41,a2]° 


From this, Equation (87) implies 


’ iT T) ,U a LO ,e 

Mavar az Ho @ IBob ©5(e) Awolr wlr, ‘T|u=a0,a1,a2] 8 IBob. (90) 
Thus, by Fact 4.32, we can assume that Equation (90) holds with equality by replacing M with G, 
incurring a loss of only ô(€) in the game value. (Unlike before, here we do not invoke Theorem 4.1 
on J”®71 to make it a projective measurement, as that would likely change the structure in 
Equation (88), which we will need later.) 


Verification. The strategy passes the verify check with probability 1 — (e€). By Equation (90) 
(which we now assume is equality), this is the same probability as if we (i) sample xo, #1, (ii) use A 
to draw wo, w1, m, (iii) draw Io, I1, J conditioned on x, #1, (iv) then draw To, T1, U conditioned 
on Ip, 11, J, (v) compute ap = wo|r,, @1 = wilr, and a2 = we|y, and (vi) give ao|z,, @1|7,, @2l7 
to Vpcpp and accept if it accepts. 

Condition on a fixed choice of £o, xı and a draw for wo,w,,7. The PCPP verifier receives 
answers to its Tọ and I, queries based on wọ and w1, which are in Subg,. In addition, although 7 is 
in Subp, and may not correspond to the encoding of an actual proof string, the verifier only queries it 
at points in the image of the embedding juz,. As a result, the answers Vpcpp receives to its J queries 
are consistent with some fixed proof string. Thus, by Proposition 17.8, since 1 — n(k) > 2y for 
all k, if the probability the verifier accepts is greater than s, then there are strings yo, y1 € {0,1}% 
such that wo = Enc (yo), wi = Ency, (y1) and V (input, £o, 71, yo, y1) = 1. Averaging over all £o, x1 
and wo, w 1,7, we conclude that 


s 1—d(€)—s 


Pr[V (input, £o, 21, Dec, (wo), Dec (wi)) = 1] > is 


= 1- d(e). (91) 
Recall that the decoding map is one-to-one except on those strings not in the range of the encoding 
map, which it maps to | instead. As we can assume that the verifier V always rejects when it 
receives L for an answer, this tells us that Decy, (wo), Deca (w1) # L with probability at least 
1 — d(e). 


Wrapping it up. Now we give a strategy for causing the verifier V to accept with high probability 
on input. It uses state 7, and given question x it applies the measurement {A*}, defined as 
Aa = GDecs, (w)=a]' 
Consider the verifier V’ which samples (a, %1), gives them to Alice and Bob, receives wo, w1, and 
accepts if V (input, £o, 21, Decs (wo), Dece, (wi)) = 1. Then V accepts on strategy A with the same 
probability that V’ accepts on strategy G. In other words, if we define S(a 9,21) to be the set of 
(wo, w1) such that 
V (input, zo, 71, Dece, (wo), Dec, (w1)) = 1, 


then the probability that V’ accepts on strategy G is 


E ` (H| Gn ® Guy |v) - (92) 
(xo,£1) 
wo,w1 ES (£0,%1) 
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To show this is large, we begin by showing that the G’s commute with each other. To see this, 
note that Equations (85) and (86) implies that for a fixed c € {0,1}, 


Aaa 8 IBob ~6(c) Taiice ® GRE 


[wer =a] [we] T. =ae]" 


However, by the distance properties of our code and the fact that Te contains a uniformly random 
index, this implies that 
Au ® IBob ~6(c) Alice D Gis (93) 


As a result, 
Gwo : Gan ® IBob 5 €) Gup Q Aom 
Sile Talic @ Ago? A 
Zile Talie @ Ay > Ann 
slo Cu ea 
(e) Gin i Gan ® Bob: 


0 


A similar argument as the one establishing (93) implies that 
Gus, Q IBob 5 (c) Ialice @ Gus, 
Thus, 
Gm © G2 = G3- G3 O GË) 
Sile Gwo ` Guy ` Cw, ® IBob 
Sace) Cw ` Fw, * Gury @ TBob 
= A u © 1 Bap: 


wo,w1 


As a result, by Fact 4.31, Equation (92) is at least 1 — 6(€) by Equation (91). This concludes the 
proof of the theorem. o 


17.5 Applying the answer reduction protocol 


In this section, we instantiate Theorem 17.10 with the low-degree code and then apply it to our 
NEEXP protocol. 


Theorem 17.11. Let V = (Algo, Alga) be an MIP* verifier for a language L. Write La for the 
language decided by Alga. Suppose on inputs of size n, the verifier V has question length ly.q(n), 
answer length ly a(n), question time ty.q(n), and answer time ty, a(n). Then there exists another 
MIP* verifier Vans for L with the following parameters. 


Q-length(Vans) = O(év,q(n) + log(év,a(n)) + log(tv a (n))), 
A-length(Vans) = O(polylog(év,a(n)) + polylog(ty.a(n))), 
Q-time(Vans) = O (tv,q(n)) + poly(n + fv,Q(n), log (év,a(n)), log (tv,a(m))) , 
A-time(Vans) = poly(n + fy,Q(n), log(év,a(n)), log(ty a (n))). 
Proof. We instantiate the low-degree code in Fact 16.9. It gives an error correcting code with 


parameters (n, poly(n), polylog(n), polylog(n)~!, poly(n), polylog(n)) and a c-subset test % with 
robustness yz(€) = poly(e,log(k)~!) such that 


Q-time(%) = poly(logk,c), A-time(Y,) = poly(log(k)°), 
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Q-length(%,) = O(clogk), A-length(%,) = O(log(k)?°). 


We then apply Theorem 17.10 with s, y = D At this point, the theorem follows immediately, but 
as deriving it can be cumbersome, we fill in the details. 
By construction, tpec(n) = poly(n). As a result, 


tcompose(n) = tva (n) + tDec(lv a (n)) = tv a(n) + poly (év,a(n)). 


Thus, 
L(t) = tcompose(n) ` polylog (tcompose (n) ) = poly(ty,a(n), £va (n)). 
Now, m(n) = poly(n). Thus, 


tpcpp(n) = poly(n + ly,q(n), log(m(£v, a (n))), log (tcompose(n))) 
= poly(n + ly,q(n), log(£v,a (n)), log(ty,a (n))). 


Furthermore, q(n) = polylog(n) and tgmp(n) = polylog(n). As a result, 
n 


The theorem now follows from applying these bounds to Theorem 17.10. O 


Crucially, although polynomial factors of ty.g(n) and fy,g(n) appear in Theorem 17.11, only 
the logarithms of ty a(n) and y.4(n) appear in this theorem. As a result, if we apply this to 
Corollary 15.9, we arrive at our main result. 


Theorem 17.12. There is an MIP* verifier Y for Succinct-Succinct-3Sat with parameters 
Q-length(Y) = O(n), A-length(Y) = poly(n), 


Q-time(Y) = poly(n), A-time(Y) = poly(n). 
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